Description
In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.
Remediation
References
Related Vulnerabilities
WordPress Plugin 404 SEO Redirection Cross-Site Scripting (1.3)
MyBB Insertion of Sensitive Information into Log File Vulnerability (CVE-2015-8977)
Apache Tomcat Improperly Implemented Security Check for Standard Vulnerability (CVE-2017-15706)
WordPress Plugin WP-Forum 'forum_feed.php' SQL Injection (1.7.8)
WordPress Plugin Target First Live chat Unspecified Vulnerability (1.0)