Authenticated Object Injection in CMS Made Simple by CMS Made Simple
CVE-2019-9056

8.8HIGH

Key Information:

Vendor
Cmsmadesimple
Status
Cms Made Simple
Vendor
CVE Published:
11 April 2019

Summary

A vulnerability exists in CMS Made Simple version 2.2.8 within the FrontEndUsers module, where an untrusted FEU cookie can lead to an unserialize call. This security flaw allows an attacker to perform authenticated object injection, potentially compromising the integrity of the application. Users are advised to upgrade to the latest version to mitigate risks associated with this vulnerability.

References

https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made...
x_refsource_CONFIRM
https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinv...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.