[PRODSECBUG-2312] PHP Object Injection in the Model Design Package could lead to arbitrary code execution – CVE-2019-7906

A PHP Object Injection vulnerability in the model design package could be exploited by an authenticated user with administrator privileges to execute arbitrate code.

Part of update SUPEE-11155

This vulnerability affects the following application versions:

• Magento 1.9.2.3
• Magento 1.9.2.4
• Magento 1.9.3.0
• Magento 1.9.3.1
• Magento 1.9.3.2
• Magento 1.9.3.3
• Magento 1.9.3.4
• Magento 1.9.3.6
• Magento 1.9.3.7
• Magento 1.9.3.8
• Magento 1.9.3.9
• Magento 1.9.3.10
• Magento 1.9.4.0
• Magento 1.9.4.1