An authenticated user with administrative privileges to store configuration could execute arbitrary code via server side request forgery (SSRF) issued to Redis. SSRF had facilitated through crafted gateway XML URL configuration.
Part of update SUPEE-11086
This vulnerability affects the following application versions:
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2
- Magento 1.9.2.3
- Magento 1.9.2.4
- Magento 1.9.3.0
- Magento 1.9.3.1
- Magento 1.9.3.2
- Magento 1.9.3.3
- Magento 1.9.3.4
- Magento 1.9.3.6
- Magento 1.9.3.7
- Magento 1.9.3.8
- Magento 1.9.3.9
- Magento 1.9.3.10
- Magento 1.9.4.0