Import and export users and customers <= 1.14.1.3 - Cross-Site Request Forgery leading to attachment deletion & Path Traversal

Reaching this weakness in Import and export users and customers <= 1.14.1.3 takes a caller who can reach the endpoint. Cross-site request forgery abuses the fact that browsers attach a victim's cookies to any request, so a state-changing action that only checks who you are, not whether you meant to act, can be triggered from another site.

An attacker who gets a logged-in user to load a crafted page can perform that action as them, with the impact scaling to whatever the victim's role is allowed to do. For Import and export users and customers the fix is 1.14.2.2: builds <= 1.14.1.3 are affected, anything from 1.14.2.2 onward is not.