Beveiligingsadvies

CVE-2019-12799

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2019-06-13 19:18:41

Laatst bijgewerkt 2024-08-04 23:32:55

Toegewezen door mitre

CVSS-score 6.5

Status PUBLISHED

Beschrijving

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.

← Alle CVE's bekijken Bekijk op cve.org ↗