PT-2022-24880 · Melisplatform · Melisplatform/Melis-Front

Published 2022-10-11 · Updated 2022-10-13 · CVE-2022-39298

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions melisplatform/melis-front versions prior to 5.0.1

Description The issue affects MelisFront, the engine that displays websites hosted on Melis Platform, handling tasks such as showing pages, plugins, URL rewriting, search optimization, and SEO. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-front, leading to the execution of arbitrary PHP code on the system without requiring authentication. This issue was addressed by restricting allowed classes when deserializing user-controlled data.

Recommendations For melisplatform/melis-front versions prior to 5.0.1, users should immediately upgrade to melisplatform/melis-front >= 5.0.1 to resolve the issue. As a temporary workaround, consider restricting the deserialization of user-controlled data to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-39298

GHSA-H479-2MV4-5C26

Affected Products

Melisplatform/Melis-Front

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39298.json · Exploit
• https://github.com/melisplatform/melis-front/commit/89ae612d5f1f7aa2fb621ee8de27dffe1feb851e · Patch
• https://osv.dev/vulnerability/CVE-2022-39298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39298 · Security Note
• https://osv.dev/vulnerability/GHSA-h479-2mv4-5c26 · Vendor Advisory
• https://github.com/melisplatform/melis-front/security/advisories/GHSA-h479-2mv4-5c26 · Note
• https://github.com/melisplatform/melis-front · Note
• https://t.me/cibsecurity/51291 · Telegram Post