GHSA-rf8f-hqjv-986p

Suggest an improvement
Source
https://github.com/advisories/GHSA-rf8f-hqjv-986p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rf8f-hqjv-986p/GHSA-rf8f-hqjv-986p.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-rf8f-hqjv-986p
Aliases
  • CVE-2019-12799
Published
2022-05-24T16:48:00Z
Modified
2024-02-16T08:16:39.454275Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Shopware Insecure Deserialization Vulnerability
Details

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.

Database specific 
{
    "nvd_published_at": "2019-06-13T20:29:00Z",
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-502"
    ],
    "github_reviewed_at": "2023-07-31T20:21:38Z",
    "github_reviewed": true
}
References

Affected packages

Packagist / shopware/shopware

Package

Name
shopware/shopware
Purl
pkg:composer/shopware/shopware

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.3.0
Last affected
5.6.0

Affected versions

5.*
5.3.0
v5.*
v5.3.4
v5.3.5
v5.3.6
v5.3.7
v5.4.0-RC1
v5.4.0
v5.4.1
v5.4.2
v5.4.3
v5.4.4
v5.4.5
v5.4.6
v5.5.0-BETA1
v5.5.0-RC1
v5.5.0
v5.5.1
v5.5.2
v5.5.3
v5.5.4
v5.5.5
v5.5.6
v5.5.7
v5.5.8
v5.5.9
v5.5.10
v5.6.0-RC1
v5.6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rf8f-hqjv-986p/GHSA-rf8f-hqjv-986p.json"