GitHub Advisoryadvisory · Packagist

GHSA-qrvj-274h-hfcg Deserialization of Untrusted Data in topthink/framework

CRITICAL Published 2021-12-07 Modified 2022-03-25 Official page ↗

Aliases: CVE-2021-36567
Ecosystem: Packagist
Packages: topthink/framework
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-502
Reviewed: 2022-03-25

Affected packages

• Packagist topthink/framework: <= 6.0.8 (no fix yet)

Description

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.

Related

Alias · CVE (1)

CVE-2021-36567 ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache. vulnerability

Weakness · CWE (1)

CWE-502 Deserialization of Untrusted Data weakness

References