CVE-2019-10912

Deserialization of Untrusted Data in packagist/typo3/cms-core

Identifiers

GHSA-w2fr-65vp-mxw3, CVE-2019-10912

Package Slug

packagist/typo3/cms-core

Vulnerability

Deserialization of Untrusted Data

Description

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

Affected Versions

All versions starting from 9.0.0 before 9.5.8

Solution

Upgrade to version 9.5.8 or above.

Last Modified

2024-02-05

source