PT-2017-13275

CVE-2017-14141

Published

2017-09-19

Updated

2019-10-17

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaltura versions prior to 13.2.0

Description The issue concerns the wiki decode Developer System Helper function in the admin panel, which allows remote attackers to conduct PHP object injection attacks. This enables the execution of arbitrary PHP code via a crafted serialized object.

Recommendations For versions prior to 13.2.0, update to version 13.2.0 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Robin Verton

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data

Related identifiers