GitHub Advisoryadvisory · Packagist

GHSA-rf8f-hqjv-986p Shopware Insecure Deserialization Vulnerability

HIGH Published 2022-05-24 Modified 2023-07-31 Official page ↗
Aliases
CVE-2019-12799
Ecosystem
Packagist
Packages
shopware/shopware
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-07-31

Affected packages

• Packagist shopware/shopware: >= 5.3.0, <= 5.6.0 (no fix yet)

Description

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.

Related

Alias · CVE (1)

  • CVE-2019-12799 In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability,… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References