GitHub Advisoryadvisory · Packagist

GHSA-96jg-pmc4-cx39 TYPO3 CMS Insecure Deserialization

HIGH Published 2024-05-30 Modified 2024-05-30 Official page ↗
Ecosystem
Packagist
Packages
typo3/cms-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2024-05-30

Affected packages

• Packagist typo3/cms-core: >= 8.5.0, < 8.7.17 → fixed in 8.7.17 • Packagist typo3/cms-core: >= 9.0.0, < 9.3.1 → fixed in 9.3.1

Description

It has been discovered that the Form Framework (system extension `form`) is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package `yaml`, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting `yaml.decode_php` enabled is needed to exploit this vulnerability (which is the default value according to PHP documentation).

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References