UpHeron
All vulnerabilities

Servers and applications

CVE-2015-1398

Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the…

Severity
Medium 6.5
Published
29 Apr 2015
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Magento / Adobe CommerceServers and applications · cpe:a:magento:magento
  • Version 1.9.1.0
  • Version 1.14.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2015-1398
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2015-1398