PT-2019-19341 · Cms Made Simple · Cms Made Simple
CVE-2019-9057
·
Published
2019-03-26
·
Updated
2022-12-02
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
CMS Made Simple version 2.2.8
Description
An issue was discovered in the FilePicker module, where it is possible to reach an unserialize call with an untrusted parameter, achieving authenticated object injection.
Recommendations
For CMS Made Simple version 2.2.8, consider restricting access to the FilePicker module to minimize the risk of exploitation until a patch is available.
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cms Made Simple