CVE-2019-12799: Deserialization of Untrusted Data

June 13, 2019 (updated October 9, 2019)

In createInstanceFromNamedArguments in Shopware, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution.

References

github.com/rapid7/metasploit-framework/pull/11828
nvd.nist.gov/vuln/detail/CVE-2019-12799

Detect and mitigate CVE-2019-12799 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →