| Package | Affected versions | Patched versions |
|---|---|---|
| magento | = 1.14.1.0= 1.9.1.0 |
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free