GHSA-74mf-vjpg-9xh7

Source

https://github.com/advisories/GHSA-74mf-vjpg-9xh7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-74mf-vjpg-9xh7/GHSA-74mf-vjpg-9xh7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-74mf-vjpg-9xh7

Aliases

CVE-2015-2171

Published

2022-05-17T03:34:17Z

Modified

2024-12-08T05:26:43.196511Z

Summary

Slim vulnerable to PHP object injection

Details

Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data.

Database specific

{
    "github_reviewed_at": "2024-04-25T22:23:09Z",
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-94"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2015-03-30T14:59:00Z"
}

References

Affected packages

Packagist / slim/slim

Package

Name: slim/slim
Purl: pkg:composer/slim/slim

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6.0

Affected versions

1.*

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

2.*

2.0.0

2.1.0

2.2.0

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.4.0

2.4.1

2.4.2

2.4.3

2.5.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-74mf-vjpg-9xh7/GHSA-74mf-vjpg-9xh7.json"