PT-2012-2023 · Silverstripe · Silverstripe

Henri Salo · Publicado 2012-09-17 · Atualizado 2022-05-17 · CVE-2011-4962

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SilverStripe versions 2.4.0 through 2.4.5

Description The issue allows remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized. This occurs in the code/sitefeatures/PageCommentInterface.php file.

Recommendations For SilverStripe versions 2.4.0 through 2.4.5, update to version 2.4.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the PageCommentInterface.php file or disabling the comment submission feature until a patch is applied. Avoid using the affected PageCommentInterface.php file in the user comment submission process until the issue is resolved.

Exploit

Correção

RCE

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-20

CWE-502

Identificadores relacionados

CVE-2011-4962

GHSA-GV6C-59H4-9PMG

Produtos afetados

Silverstripe

Referências · 10

• 🔥 https://github.com/silverstripe/silverstripe-cms/commit/d15e850 · Exploit
• https://github.com/silverstripe/silverstripe-cms · Nota
• https://github.com/silverstripe/silverstripe-cms/commit/d15e8509b01ff2dbbe3028a055021a29b1065b22 · Nota
• http://openwall.com/lists/oss-security/2012/04/30/1 · Correção
• https://web.archive.org/web/20120621234353/http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6 · Nota
• http://openwall.com/lists/oss-security/2012/04/30/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4962 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4962 · Nota
• https://osv.dev/vulnerability/GHSA-gv6c-59h4-9pmg · Aviso do Fabricante
• http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6 · Aviso do Fabricante