An administrator with limited privileges could insert injectable XML into the layout table, which could create an opportunity for remote code execution.
Part of patch SUPEE-10570
This vulnerability affects the following application versions:
- Magento 1.9.1.1
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2
- Magento 1.9.2.3
- Magento 1.9.2.4
- Magento 1.9.3.0
- Magento 1.9.3.1
- Magento 1.9.3.2
- Magento 1.9.3.3
- Magento 1.9.3.4
- Magento 1.9.3.6
- Magento 1.9.3.7