CVE-2019-12799
CVE-2019-12799
Vexday Risk Score
40Atención
Decisión SSVC (CISA)
Attend
PoC disponible → seguir de cerca
Madurez del exploit
Exploit funcional
Exploit automatizable disponible (Nuclei/Metasploit).
CVSS 6.5EPSS 54.7%KEV nãoPoC —Nuclei —Metasploit simPatch —
Ciclo de vida
09 may 2019Exploit Metasploit disponible
13 jun 2019Publicada en NVD
Recomendación: Planificar corrección próxima — ya existe PoC pública.
In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.
CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N
Productos afectados
n/a · n/a