Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1oNDc5LTJtdjQtNWMyNs4AAvPd
melisplatform/melis-front vulnerable to deserialization of untrusted data
Impact
Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-front
, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication.
Users should immediately upgrade to melisplatform/melis-front
>= 5.0.1.
Patches
This issue was addressed by restricting allowed classes when deserializing user-controlled data.
References
For more information
If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNDc5LTJtdjQtNWMyNs4AAvPd
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: over 1 year ago
CVSS Score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Identifiers: GHSA-h479-2mv4-5c26, CVE-2022-39298
References:
- https://github.com/melisplatform/melis-front/security/advisories/GHSA-h479-2mv4-5c26
- https://github.com/melisplatform/melis-front/commit/89ae612d5f1f7aa2fb621ee8de27dffe1feb851e
- https://nvd.nist.gov/vuln/detail/CVE-2022-39298
- https://github.com/advisories/GHSA-h479-2mv4-5c26
Blast Radius: 8.6
Affected Packages
packagist:melisplatform/melis-front
Dependent packages: 14Dependent repositories: 13
Downloads: 4,352 total
Affected Version Ranges: < 5.0.1
Fixed in: 5.0.1
All affected versions: 2.1.1, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.5.0, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.1.0, 4.1.1, 4.1.2, 5.0.0
All unaffected versions: 5.0.1, 5.0.2, 5.0.3, 5.1.0