GitHub Advisoryadvisory · Packagist

GHSA-m3m3-6gww-7gj9 melisplatform/melis-cms vulnerable to deserialization of untrusted data

HIGH Published 2022-10-11 Modified 2022-10-13 Official page ↗
Aliases
CVE-2022-39297
Ecosystem
Packagist
Packages
melisplatform/melis-cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-502
Reviewed
2022-10-11

Affected packages

• Packagist melisplatform/melis-cms: < 5.0.1 → fixed in 5.0.1

Description

Impact Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1. Patches This issue was addressed by restricting allowed classes when deserializing user-controlled data. References • https://github.com/melisplatform/melis-cms/commit/d124b2474699a679a24ec52620cadceb3d4cec11 For more information If you have any questions or comments about this advisory, you can contact: • The original reporters, by sending an email to vulnerability.research [at] sonarsource.com; • The maintainers, by opening an issue on this repository.

Related

Alias · CVE (1)

  • CVE-2022-39297 MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References