PT-2019-5880 · Phpfastcache · Phpfastcache

Geolim4 · Publicado 2019-12-12 · Atualizado 2020-10-07 · CVE-2019-16774

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpfastcache versions prior to 5.1.3

Description The issue is related to shortcomings in the deserialization mechanism of the PhpFastCache library. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability is associated with a possible object injection in the cookie driver.

Recommendations For versions prior to 5.1.3, consider using another driver, such as the "Files" (Filesystem) driver, as a temporary workaround until the issue is resolved. Update to version 5.1.3 or later, which enforces JSON conversion when deserializing to address the issue.

Correção

Deserialization of Untrusted Data

Code Injection

Enumeração de Fraquezas

CWE-502

CWE-94

Identificadores relacionados

BDU:2021-03584

CVE-2019-16774

GHSA-484F-743F-6JX2

Produtos afetados

Phpfastcache

Referências · 11

• https://github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-484f-743f-6jx2 · Nota
• https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13 · Nota
• https://github.com/PHPSocialNetwork/phpfastcache/commit/c4527205cb7a402b595790c74310791f5b04a1a4 · Correção
• https://github.com/PHPSocialNetwork/phpfastcache · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-16774 · Nota de Segurança
• https://vuldb.com/?id.147087 · Nota
• https://osv.dev/vulnerability/GHSA-484f-743f-6jx2 · Aviso do Fabricante
• https://github.com/advisories/GHSA-484f-743f-6jx2 · Nota
• https://cxsecurity.com/cveshow/CVE-2019-16774 · Nota
• https://osv.dev/vulnerability/CVE-2019-16774 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2021-03584 · Nota de Segurança