Insecure Unserialize Vulnerability in FLOW3

2024-06-0520:47:07

GitHub Advisory Database

github.com

insecure unserialize

flow3

missing signature

hmac

arbitrary object

vulnerability

user applications

software

7.3 High

AI Score

Confidence

High

JSON

Due to a missing signature (HMAC) for a request argument, an attacker could unserialize arbitrary objects within FLOW3.

To our knowledge it is neither possible to inject code through this vulnerability, nor are there exploitable objects within the FLOW3 Base Distribution. However, there might be exploitable objects within user applications.

Affected configurations

Vulners

Node

typo3flowRange<1.0.4

CPENameOperatorVersion
typo3/flowlt1.0.4

CPE	Name	Operator	Version
	typo3/flow	lt	1.0.4

References

github.com/advisories/GHSA-m2hp-5x78-74mg

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/flow/2012-03-28.yaml

www.neos.io/blog/flow-sa-2012-001.html

7.3 High

AI Score

Confidence

High

JSON