GHSA-96jg-pmc4-cx39
Suggest an improvement- Source
- https://github.com/advisories/GHSA-96jg-pmc4-cx39
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-96jg-pmc4-cx39/GHSA-96jg-pmc4-cx39.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-96jg-pmc4-cx39
- Published
- 2024-05-30T14:52:14Z
- Modified
- 2024-12-05T05:42:20.937886Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- TYPO3 CMS Insecure Deserialization
- Details
-
It has been discovered that the Form Framework (system extension
form) is vulnerable to Insecure Deserialization when being used with the additional PHP PECL packageyaml, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP settingyaml.decode_phpenabled is needed to exploit this vulnerability (which is the default value according to PHP documentation). - Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-502" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-05-30T14:52:14Z" }- References
Affected packages
Packagist / typo3/cms-core
Package
- Name
- typo3/cms-core
- Purl
- pkg:composer/typo3/cms-core
Packagist / typo3/cms-core
Package
- Name
- typo3/cms-core
- Purl
- pkg:composer/typo3/cms-core