An administrator with limited privileges could insert injectable code in promo fields, creating an opportunity for arbitrary remote code execution. Part of SUPEE-10415.
This vulnerability affects the following application versions:
- Magento 1.9.2.3
- Magento 1.9.2.4
- Magento 1.9.3.0
- Magento 1.9.3.1
- Magento 1.9.3.2
- Magento 1.9.3.3
- Magento 1.9.3.4
- Magento 1.9.3.6