Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1tM20zLTZnd3ctN2dqOc4AAvPe
melisplatform/melis-cms vulnerable to deserialization of untrusted data
Impact
Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-cms
, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication.
Users should immediately upgrade to melisplatform/melis-cms
>= 5.0.1.
Patches
This issue was addressed by restricting allowed classes when deserializing user-controlled data.
References
For more information
If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tM20zLTZnd3ctN2dqOc4AAvPe
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: over 1 year ago
CVSS Score: 7.7
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Identifiers: GHSA-m3m3-6gww-7gj9, CVE-2022-39297
References:
- https://github.com/melisplatform/melis-cms/security/advisories/GHSA-m3m3-6gww-7gj9
- https://github.com/melisplatform/melis-cms/commit/d124b2474699a679a24ec52620cadceb3d4cec11
- https://nvd.nist.gov/vuln/detail/CVE-2022-39297
- https://github.com/advisories/GHSA-m3m3-6gww-7gj9
Blast Radius: 8.8
Affected Packages
packagist:melisplatform/melis-cms
Dependent packages: 15Dependent repositories: 14
Downloads: 4,688 total
Affected Version Ranges: < 5.0.1
Fixed in: 5.0.1
All affected versions: 2.1.1, 2.2.0, 2.2.1, 2.3.0, 2.3.1, 2.4.0, 2.5.0, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.2.10, 3.2.11, 3.2.12, 3.2.13, 3.2.14, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9, 4.0.10, 4.0.11, 4.1.0, 4.1.1, 4.1.2, 5.0.0
All unaffected versions: 5.0.1, 5.1.0, 5.1.1