CVE-2019-9061

An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2019-03-26

Last modified

2024-08-04

Weaknesses

CWE-1321, CWE-502

Affected products

• Cms Made Simple (Cmsmadesimple)

References

• https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg
• https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum