CVE-2020-4043highCWE-502

CVE-2020-4043: falha de alta gravidade em phpMussel

Phar unserialization vulnerability in phpMussel

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar phpMussel+ Monitorar maikuolan/phpmussel

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 2.6%
phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don't use PHP's phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Produtos afetados
phpMussel · phpMussel