PT-2024-40193 · Php+1 · Yaml+1
Published
2024-06-05
·
Updated
2024-06-05
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
Form Framework (system extension "form") (affected versions not specified)
Description:
The issue concerns Insecure Deserialization in the Form Framework when used with the PHP PECL package "yaml". This package can unserialize YAML contents to PHP objects. To exploit this, a valid backend user account is required, along with the PHP setting
yaml.decode php enabled, which is the default according to PHP documentation.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Form Framework
Yaml