A stored cross-site scripting vulnerability had existed in the WYSIWYG editor. This could be exploited by an authenticated user with privileges to the editor to inject malicious SWF files.
Part of update Magento 2.3.2, 2.2.9 and 2.1.18 Security Update 2/3
This vulnerability affects the following application versions:
- Magento 1.9.1.1
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2
- Magento 1.9.2.3
- Magento 1.9.2.4
- Magento 1.9.3.0
- Magento 1.9.3.1
- Magento 1.9.3.2
- Magento 1.9.3.3
- Magento 1.9.3.4
- Magento 1.9.3.6
- Magento 1.9.3.7
- Magento 1.9.3.8
- Magento 1.9.3.9
- Magento 1.9.3.10
- Magento 1.9.4.0
- Magento 1.9.4.1