1

This question already has an answer here:

The Description of the patch SUPEE-11086 is:

SUPEE-11086, Magento Commerce 1.14.4.1 and Open Source 1.9.4.1 contain multiple security enhancements that help close remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF) and other vulnerabilities.

Also includes patch for SQL Injection with CVSSv3 Severity: 9.0

An unauthenticated user can execute arbitrary code through an SQL injection vulnerability, which causes sensitive data leakage.

Are there any issues or problems we can expect from this patch?

marked as duplicate by Amit Bera Mar 27 at 3:26

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • @Amit my question is specific for magento1. The other question is for both versions (m1 and m2). You also commented on the other question that he should make different questions for m1 and m2 – karpa Mar 27 at 10:12
1

The following files are added or amended (in the 1.9.4.0 version of the patch, there may be more in older M1 versions):

app/Mage.php
app/code/core/Mage/Admin/Model/Session.php
app/code/core/Mage/Adminhtml/Block/Api/Buttons.php
app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit.php
app/code/core/Mage/Adminhtml/Block/Customer/Group/Edit.php
app/code/core/Mage/Adminhtml/Block/Permissions/Buttons.php
app/code/core/Mage/Adminhtml/Block/System/Design/Edit.php
app/code/core/Mage/Adminhtml/Block/System/Store/Edit.php
app/code/core/Mage/Adminhtml/Controller/Action.php
app/code/core/Mage/Adminhtml/Helper/Data.php
app/code/core/Mage/Adminhtml/Model/Email/PathValidator.php
app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Gatewayurl.php
app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Protected.php
app/code/core/Mage/Adminhtml/controllers/Api/RoleController.php
app/code/core/Mage/Adminhtml/controllers/Api/UserController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/Action/AttributeController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/AttributeController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/Product/WidgetController.php
app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
app/code/core/Mage/Adminhtml/controllers/Cms/WysiwygController.php
app/code/core/Mage/Adminhtml/controllers/CustomerController.php
app/code/core/Mage/Adminhtml/controllers/Permissions/RoleController.php
app/code/core/Mage/Adminhtml/controllers/Permissions/UserController.php
app/code/core/Mage/Adminhtml/controllers/Promo/CatalogController.php
app/code/core/Mage/Adminhtml/controllers/Promo/QuoteController.php
app/code/core/Mage/Adminhtml/controllers/System/BackupController.php
app/code/core/Mage/Adminhtml/controllers/System/DesignController.php
app/code/core/Mage/Api2/Block/Adminhtml/Roles/Buttons.php
app/code/core/Mage/Api2/controllers/Adminhtml/Api2/AttributeController.php
app/code/core/Mage/Api2/controllers/Adminhtml/Api2/RoleController.php
app/code/core/Mage/Catalog/Model/Product/Option/Type/Select.php
app/code/core/Mage/Cms/Helper/Data.php
app/code/core/Mage/Cms/etc/config.xml
app/code/core/Mage/Core/Block/Abstract.php
app/code/core/Mage/Core/Helper/Abstract.php
app/code/core/Mage/Core/Model/File/Validator/StreamWrapper.php
app/code/core/Mage/Core/Model/Input/Filter/MaliciousCode.php
app/code/core/Mage/Core/etc/system.xml
app/code/core/Mage/Eav/Model/Attribute/Data/File.php
app/code/core/Mage/Eav/Model/Entity/Attribute/Abstract.php
app/code/core/Mage/Oauth/controllers/Adminhtml/Oauth/ConsumerController.php
app/code/core/Mage/Rss/etc/system.xml
app/code/core/Mage/Usa/etc/system.xml
app/code/core/Mage/Widget/controllers/Adminhtml/Widget/InstanceController.php
app/etc/config.xml
app/locale/en_US/Mage_Adminhtml.csv
app/locale/en_US/Mage_Core.csv
app/locale/en_US/Mage_Rss.csv
app/locale/en_US/Mage_Widget.csv
lib/Varien/Db/Adapter/Pdo/Mysql.php
lib/Varien/Filter/Template.php

Not the answer you're looking for? Browse other questions tagged or ask your own question.