GHSA-8237-957h-h2c2

Source

https://github.com/advisories/GHSA-8237-957h-h2c2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-8237-957h-h2c2/GHSA-8237-957h-h2c2.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-8237-957h-h2c2

Aliases

CVE-2024-52306

Published

2024-11-13T18:43:02Z

Modified

2024-11-18T20:57:43.931032Z

Severity

7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

FileManager Deserialization of Untrusted Data vulnerability

Details

Impact

Deserialization of untrusted data from the mimes parameter could lead to remote code execution.

Patches

Fixed in 3.0.9

Workarounds

Not needed, a composer update will solve it in a non-breaking way.

References

Reported responsibly Vladislav Gladkiy at Positive Technologies.

Database specific

{
    "nvd_published_at": "2024-11-13T16:15:20Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-13T18:43:02Z"
}

References

Affected packages

Packagist / backpack/filemanager

Package

Name: backpack/filemanager
Purl: pkg:composer/backpack/filemanager

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.0.9

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

Packagist / backpack/filemanager

Package

Name: backpack/filemanager
Purl: pkg:composer/backpack/filemanager

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.2

Affected versions

1.*

1.0.0

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

2.*

2.0.0

2.0.1