Remote code execution (RCE) by unprivileged user because of custom deserialization of untrusted data
Package
No package listed
Affected versions
< 4.1.0
Patched versions
4.1.0
Description
Credits
-
JarLob Analyst
JarLob
Analyst
Impact
This vulnerability affects Smartstore shops prior version 4.1.0 where user uploads are enabled.
Patches
This vulnerability is closed in version 4.1.0.
Workarounds
Disable all user upload possibilities > avatar uploads & attribute uploads.