Authenticated Object Injection in CMS Made Simple ModuleManager
CVE-2019-9061

8.8HIGH

Key Information:

Vendor
Cmsmadesimple
Status
Cms Made Simple
Vendor
CVE Published:
26 March 2019

Summary

A vulnerability exists in CMS Made Simple version 2.2.8, specifically within the ModuleManager component. This flaw allows attackers to leverage the 'install module' feature improperly. By submitting untrusted input, an attacker can trigger an unserialize call, leading to potential authenticated object injection. This could enable unauthorized actions or access to sensitive data within the application's environment.

References

https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made...
x_refsource_CONFIRM
https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinv...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.