PT-2019-14243 · Fork+1 · Fork Cms+1

Stijn Vrolijk · Published 2019-08-26 · Updated 2022-05-24 · CVE-2019-15521

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spoon Library versions through 2014-02-06 Fork CMS versions prior to 1.4.1

Description The issue allows PHP object injection via a cookie containing an object. This can be exploited by manipulating the cookie to inject malicious PHP objects.

Recommendations For Spoon Library versions through 2014-02-06, update to a version released after 2014-02-06 to resolve the issue. For Fork CMS versions prior to 1.4.1, update to version 1.4.1 or later to fix the problem. As a temporary workaround, consider restricting access to cookies or validating user-input data to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2019-15521

GHSA-2P2X-MW56-JC98

Affected Products

Fork Cms

Spoon Library

References · 7

• https://github.com/spoon/library/blob/bda89be80b7e1ffdc93d3180d33a56927430298b/spoon/cookie/cookie.php#L117 · Patch
• https://github.com/forkcms/library/pull/69 · Patch
• https://osv.dev/vulnerability/GHSA-2p2x-mw56-jc98 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15521 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15521 · Security Note
• https://github.com/forkcms/library/releases/tag/1.4.1 · Note
• https://github.com/forkcms/library · Note