Cross-site request forgery in Magento Connect Manager allowed an attacker to execute actions such as the installation of a remote module that leads to the execution of remote code. The attack required a Magento store administrator, while logged in to Magento Connect Manager, to click a link that was prepared by the attacker.
Part of patch SUPEE-6285
This vulnerability affects the following application versions:
- Magento 1.1.5
- Magento 1.1.6
- Magento 1.1.7
- Magento 1.1.8
- Magento 1.2.0
- Magento 1.2.0.1
- Magento 1.2.0.2
- Magento 1.2.0.3
- Magento 1.2.1
- Magento 1.2.1.1
- Magento 1.2.1.2
- Magento 1.3.0
- Magento 1.3.1
- Magento 1.3.1.1
- Magento 1.3.2
- Magento 1.3.2.1
- Magento 1.3.2.2
- Magento 1.3.2.3
- Magento 1.3.2.4
- Magento 1.3.3.0
- Magento 1.4.0.0
- Magento 1.4.0.1
- Magento 1.4.1.0
- Magento 1.4.1.1
- Magento 1.4.2.0
- Magento 1.5.0.1
- Magento 1.5.1.0
- Magento 1.6.0.0
- Magento 1.6.1.0
- Magento 1.6.2.0
- Magento 1.7.0.0
- Magento 1.7.0.1
- Magento 1.7.0.2
- Magento 1.8.0.0
- Magento 1.8.1.0
- Magento 1.9.0.0
- Magento 1.9.0.1
- Magento 1.9.1.0
- Magento 1.9.1.1