1

The Description of the patch SUPEE-11086 is:

SUPEE-11086, Magento Commerce 1.14.4.1 and Open Source 1.9.4.1 contain multiple security enhancements that help close remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF) and other vulnerabilities.

Also includes patch for SQL Injection with CVSSv3 Severity: 9.0

An unauthenticated user can execute arbitrary code through an SQL injection vulnerability, which causes sensitive data leakage.

Are there any issues or problems we can expect from this patch?

Improve this question
1
  • @Amit my question is specific for magento1. The other question is for both versions (m1 and m2). You also commented on the other question that he should make different questions for m1 and m2
    – karpa
    Mar 27, 2019 at 10:12

1 Answer 1

Reset to default
1

The following files are added or amended (in the 1.9.4.0 version of the patch, there may be more in older M1 versions):

app/Mage.php
app/code/core/Mage/Admin/Model/Session.php
app/code/core/Mage/Adminhtml/Block/Api/Buttons.php
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit.php
app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php
app/code/core/Mage/Adminhtml/Block/Permissions/Buttons.php
app/code/core/Mage/Adminhtml/Block/System/Design/Edit.php
app/code/core/Mage/Adminhtml/Block/System/Store/Edit.php
app/code/core/Mage/Adminhtml/Controller/Action.php
app/code/core/Mage/Adminhtml/Helper/Data.php
app/code/core/Mage/Adminhtml/Model/Email/PathValidator.php
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Gatewayurl.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Protected.php
app/code/core/Mage/Adminhtml/controllers/Api/RoleController.php
app/code/core/Mage/Adminhtml/controllers/Api/UserController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/Action/AttributeController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/WidgetController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
app/code/core/Mage/Adminhtml/controllers/Cms/WysiwygController.php
app/code/core/Mage/Adminhtml/controllers/CustomerController.php
app/code/core/Mage/Adminhtml/controllers/Permissions/RoleController.php
app/code/core/Mage/Adminhtml/controllers/Permissions/UserController.php
app/code/core/Mage/Adminhtml/controllers/Promo/CatalogController.php
app/code/core/Mage/Adminhtml/controllers/Promo/QuoteController.php
app/code/core/Mage/Adminhtml/controllers/System/BackupController.php
app/code/core/Mage/Adminhtml/controllers/System/DesignController.php
app/code/core/Mage/Api2/Block/Adminhtml/Roles/Buttons.php
app/code/core/Mage/Api2/controllers/Adminhtml/Api2/AttributeController.php
app/code/core/Mage/Api2/controllers/Adminhtml/Api2/RoleController.php
app/code/core/Mage/Catalog/Model/Product/Option/Type/Select.php
app/code/core/Mage/Cms/Helper/Data.php
app/code/core/Mage/Cms/etc/config.xml
app/code/core/Mage/Core/Block/Abstract.php
app/code/core/Mage/Core/Helper/Abstract.php
app/code/core/Mage/Core/Model/File/Validator/StreamWrapper.php
app/code/core/Mage/Core/Model/Input/Filter/MaliciousCode.php
app/code/core/Mage/Core/etc/system.xml
app/code/core/Mage/Eav/Model/Attribute/Data/File.php
app/code/core/Mage/Eav/Model/Entity/Attribute/Abstract.php
app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/ConsumerController.php
app/code/core/Mage/Rss/etc/system.xml
app/code/core/Mage/Usa/etc/system.xml
app/code/core/Mage/Widget/controllers/Adminhtml/Widget/InstanceController.php
app/etc/config.xml
app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Core.csv
app/locale/en_US/Mage_Rss.csv
app/locale/en_US/Mage_Widget.csv
lib/Varien/Db/Adapter/Pdo/Mysql.php
lib/Varien/Filter/Template.php
Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.