GitHub Advisoryadvisory · Packagist

GHSA-442f-wcwq-fpcf Prevent RCE when deserializing untrusted user input

HIGH Published 2022-11-21 Modified 2022-11-21 Official page ↗
Aliases
CVE-2022-41922
Ecosystem
Packagist
Packages
yiisoft/yii
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-11-21

Affected packages

• Packagist yiisoft/yii: < 1.1.27 → fixed in 1.1.27

Description

Impact Affected versions of `yiisoft/yii` are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. Patches Upgrade `yiisoft/yii` to version 1.1.27 or higher. For more information See the following links for more details: • Git commit • https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection If you have any questions or comments about this advisory, contact us through security form.

Related

Alias · CVE (1)

  • CVE-2022-41922 `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References