Vulnerability · Published Oct 12, 2022 · Assigned by GitHub_M

CVE-2022-39297Deserialization of untrusted data in MelisCms

High 7.7

In plain English

A high-severity unsafe deserialization in melis-cms from melisplatform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)1.3%top 30.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	melisplatform/melis-cms	5.0.1	GHSA-m3m3-6gww-7gj9

Affected products (as reported)

Vendor	Product	Versions
melisplatform	melis-cms	<= 5.0.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References