PT-2025-3254 · Unknown · Plaininventory

Lvt-Tholv2K · Published 2025-01-07 · Updated 2025-01-07 · CVE-2024-56291

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PlainInventory versions 3.1.6 and earlier

Description The issue is related to the deserialization of untrusted data, which allows object injection. This can be exploited due to the vulnerability in handling data deserialization.

Recommendations For versions 3.1.6 and earlier, update to a version later than 3.1.6 to resolve the issue. As a temporary workaround, consider restricting the deserialization of untrusted data to minimize the risk of object injection.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-56291

Affected Products

Plaininventory

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-56291 · Security Note
• https://twitter.com/CVEnew/status/1876587691254407438 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/z-inventory-manager/vulnerability/wordpress-plaininventory-inventory-management-plugin-plugin-3-1-6-php-object-injection-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/z-inventory-manager/vulnerability/wordpress-plaininventory-inventory-management-plugin-plugin-3-1-6-php-object-injection-vulnerability?_s_id=cve · Note