CVE-2019-12799
40Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 6.5epss 55%
da publicação à arma0 dias
Publicada no NVD13 de jun.
metasploit9 de mai.
probabilidade de exploração
55%top 1% das CVEs
exploração observada
nãonenhuma fonte reporta
In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.
CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
Produtos afetados
n/a · n/a