[APPSEC-1838] RSS session admin cookie could be used to gain administrator privileges

An attacker could use a low privilege RSS session cookie to escalate privileges and gain access to the Magento Admin Portal.

Part of patch SUPEE-10266

This vulnerability affects the following application versions:

• Magento 1.9.1.1
• Magento 1.9.2.0
• Magento 1.9.2.1
• Magento 1.9.2.2
• Magento 1.9.2.3
• Magento 1.9.2.4
• Magento 1.9.3.0
• Magento 1.9.3.1
• Magento 1.9.3.2
• Magento 1.9.3.3
• Magento 1.9.3.4