Описание
In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store a preference. An attacker either needs a "public link" of a file, or access to any unprivileged user account for creation of such a link.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 8.2.2 (исключая)
cpe:2.3:a:pydio:pydio:*:*:*:*:*:*:*:*
EPSS
Процентиль: 93%
0.09386
Низкий
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-502
Связанные уязвимости
CVSS3: 9.8
debian
около 7 лет назад
In Pydio before 8.2.2, an attack is possible via PHP Object Injection ...
CVSS3: 9.8
github
больше 3 лет назад
In Pydio before 8.2.2, an attack is possible via PHP Object Injection because a user is allowed to use the $phpserial$a:0:{} syntax to store a preference. An attacker either needs a "public link" of a file, or access to any unprivileged user account for creation of such a link.
EPSS
Процентиль: 93%
0.09386
Низкий
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-502