Vulnerability · Published Oct 12, 2022 · Assigned by GitHub_M

CVE-2022-39298Deserialization of untrusted data in MelisFront

High 7.7

In plain English

A high-severity unsafe deserialization in melis-front from melisplatform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)1.3%top 30.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewritting, search optimization and SEO, etc. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-front`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-front` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	melisplatform/melis-front	5.0.1	GHSA-h479-2mv4-5c26

Affected products (as reported)

Vendor	Product	Versions
melisplatform	melis-front	<= 5.0.0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References