HIGH7.2

GHSA-qp43-2vhf-cj8g

Magento Remote code execution through support/output path modification

Quick fix

GHSA-qp43-2vhf-cj8g — magento/core: upgrade to the fixed version with the command below.

composer require magento/core:^1.9.4.3

Details

In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/magento/core

Introduced in: 0Fixed in: 1.9.4.3

Fixcomposer require magento/core:^1.9.4.3

References

https://nvd.nist.gov/vuln/detail/CVE-2019-8230[ADVISORY]
https://magento.com/security/patches/supee-11219[WEB]