GitHub Advisoryadvisory · Packagist

GHSA-5rv2-vvmf-f7w8 PHPEMS Deserialization of Untrusted Data vulnerability

MEDIUM Published 2023-12-10 Modified 2024-01-11 Official page ↗
Aliases
CVE-2023-6654
Ecosystem
Packagist
Packages
phpems/phpems
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-502
Reviewed
2024-01-11

Affected packages

• Packagist phpems/phpems: >= 6.0.0, <= 6.1.3 (no fix yet)

Description

A vulnerability classified as critical was found in PHPEMS 6.x/7.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.

Related

Alias · CVE (1)

  • CVE-2023-6654 A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References