ByteOS Network

NVD Vulnerability Details :

CVE-2018-1000525

Analyzed

Source-cve@mitre.org

Published At-26 Jun, 2018 | 16:29

Updated At-24 Aug, 2020 | 17:37

openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Specially crafted GET request variable containing serialised PHP object. This vulnerability appears to have been fixed in after commit 097eae0.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

openpsa2>>openpsa>>-

cpe:2.3:a:openpsa2:openpsa:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-502	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://0dd.zone/2018/05/31/OpenPSA-Object-Injection/	cve@mitre.org	Exploit Third Party Advisory
https://github.com/flack/openpsa/issues/191	cve@mitre.org	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History