GHSA-8237-957h-h2c2

Suggest an improvement
Source
https://github.com/advisories/GHSA-8237-957h-h2c2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-8237-957h-h2c2/GHSA-8237-957h-h2c2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8237-957h-h2c2
Aliases
Published
2024-11-13T18:43:02Z
Modified
2024-11-18T20:41:59Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FileManager Deserialization of Untrusted Data vulnerability
Details

Impact

Deserialization of untrusted data from the mimes parameter could lead to remote code execution.

Patches

Fixed in 3.0.9

Workarounds

Not needed, a composer update will solve it in a non-breaking way.

References

Reported responsibly Vladislav Gladkiy at Positive Technologies.

Database specific 
{
    "cwe_ids": [
        "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-13T18:43:02Z",
    "nvd_published_at": "2024-11-13T16:15:20Z",
    "severity": "HIGH"
}
References

Affected packages

Packagist / backpack/filemanager

Package

Name
backpack/filemanager
Purl
pkg:composer/backpack/filemanager

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.0.9

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-8237-957h-h2c2/GHSA-8237-957h-h2c2.json"

Packagist / backpack/filemanager

Package

Name
backpack/filemanager
Purl
pkg:composer/backpack/filemanager

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.2

Affected versions

1.*
1.0.0
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
2.*
2.0.0
2.0.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-8237-957h-h2c2/GHSA-8237-957h-h2c2.json"