You can download order comments and other order-related information by providing special parameters to the RSS feed request. This information, depending on contents of the order comments, could disclose private information or be used to access customer account or other customer information.
Part of patch SUPEE-7405
This vulnerability affects the following application versions:
- Magento 1.8.0.0
- Magento 1.8.1.0
- Magento 1.9.0.0
- Magento 1.9.0.1
- Magento 1.9.1.0
- Magento 1.9.1.1
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2