Layout XML Arbitrary Code Fix · CVE-2021-32758 · GitHub Advisory Database · GitHub

Layout XML Arbitrary Code Fix

High severity GitHub Reviewed Published Aug 27, 2021 in OpenMage/magento-lts • Updated Feb 1, 2023

Package

openmage/magento-lts (Composer)

Affected versions

< 19.4.15

>= 20.0.0, < 20.0.13

Patched versions

19.4.15

20.0.13

Description

Impact

Layout XML enabled admin users to execute arbitrary commands via block methods.

References

mark-netalico published to OpenMage/magento-lts

Aug 27, 2021

Published by the National Vulnerability Database

Aug 27, 2021

Reviewed Aug 30, 2021

Published to the GitHub Advisory Database Aug 30, 2021

Last updated Feb 1, 2023