An authenticated user with administrative privileges to import features could execute arbitrary code through a crafted configuration archive file upload.
Part of update SUPEE-11219
This vulnerability affects the following application versions:
- Magento 1.9.3.2
- Magento 1.9.3.3
- Magento 1.9.3.4
- Magento 1.9.3.6
- Magento 1.9.3.7
- Magento 1.9.3.8
- Magento 1.9.3.9
- Magento 1.9.3.10
- Magento 1.9.4.0
- Magento 1.9.4.1
- Magento 1.9.4.2