PT-2019-14243 · Fork+1 · Fork Cms+1

Stijn Vrolijk · Publicado 2019-08-26 · Atualizado 2022-05-24 · CVE-2019-15521

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spoon Library versions through 2014-02-06 Fork CMS versions prior to 1.4.1

Description The issue allows PHP object injection via a cookie containing an object. This can be exploited by manipulating the cookie to inject malicious PHP objects.

Recommendations For Spoon Library versions through 2014-02-06, update to a version released after 2014-02-06 to resolve the issue. For Fork CMS versions prior to 1.4.1, update to version 1.4.1 or later to fix the problem. As a temporary workaround, consider restricting access to cookies or validating user-input data to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-15521

GHSA-2P2X-MW56-JC98

Produtos afetados

Fork Cms

Spoon Library

Referências · 7

• https://github.com/spoon/library/blob/bda89be80b7e1ffdc93d3180d33a56927430298b/spoon/cookie/cookie.php#L117 · Correção
• https://github.com/forkcms/library/pull/69 · Correção
• https://github.com/forkcms/library/releases/tag/1.4.1 · Nota
• https://github.com/forkcms/library · Nota
• https://osv.dev/vulnerability/GHSA-2p2x-mw56-jc98 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-15521 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15521 · Nota de Segurança