GHSA-74mf-vjpg-9xh7

Source

https://github.com/advisories/GHSA-74mf-vjpg-9xh7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-74mf-vjpg-9xh7/GHSA-74mf-vjpg-9xh7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-74mf-vjpg-9xh7

Aliases

CVE-2015-2171

Published

2022-05-17T03:34:17Z

Modified

2024-12-08T05:26:43Z

Summary

Slim vulnerable to PHP object injection

Details

Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data.

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-25T22:23:09Z",
    "nvd_published_at":  "2015-03-30T14:59:00Z",
    "severity":  "HIGH"
}

References

Affected packages

Packagist / slim/slim

Package

Name: slim/slim
Purl: pkg:composer/slim/slim

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.6.0

Affected versions

1.*

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

2.*

2.0.0

2.1.0

2.2.0

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.4.0

2.4.1

2.4.2

2.4.3

2.5.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-74mf-vjpg-9xh7/GHSA-74mf-vjpg-9xh7.json"