Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Magento Community Edition和Enterprise Edition 安全漏洞
Vulnerability Description
Magento是美国Magento公司的一套开源的PHP电子商务系统，它提供权限管理、搜索引擎和支付网关等功能。Magento Community Edition（CE）是一个社区版。Magento Enterprise Edition（EE）是一个企业版。 Magento CE 1.9.1.0版本和EE 1.14.1.0版本的Mage_Core_Block_Template_Zend类中的‘fetchView’函数存在安全漏洞，该漏洞源于程序没有正确限制在模版路径中使用流封装。远程攻击者可借助phar:
CVSS Information
N/A
Vulnerability Type
N/A