VDB
Sign up
HIGH8.8

GHSA-j4fq-3fm7-wh5v

Magento arbitrary PHP code execution via the productData parameter

Quick fix

GHSA-j4fq-3fm7-wh5v — magento/core: upgrade to the fixed version with the command below.

composer require magento/core:^1.9.2.1

Details

The create function in `app/code/core/Mage/Catalog/Model/Product/Api/V2.php` in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to `index.php/api/v2_soap`.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/magento/core
Introduced in: 0Fixed in: 1.9.2.1
Fixcomposer require magento/core:^1.9.2.1

References