[APPSEC-2061] Authenticated unauthorised data access via layout injection

An administrator with limited permissions was able to obtain information outside of his permissions.

Part of update SUPEE-10888

This vulnerability affects the following application versions:

• Magento 1.9.1.1
• Magento 1.9.2.0
• Magento 1.9.2.1
• Magento 1.9.2.2
• Magento 1.9.2.3
• Magento 1.9.2.4
• Magento 1.9.3.0
• Magento 1.9.3.1
• Magento 1.9.3.2
• Magento 1.9.3.3
• Magento 1.9.3.4
• Magento 1.9.3.6
• Magento 1.9.3.7
• Magento 1.9.3.8
• Magento 1.9.3.9