GHSA-7h74-7vcw-4mwp
GHSA-7h74-7vcw-4mwp · Insecure deserialize Vulnerability in FLOW3
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Due to a missing signature (HMAC) for a request argument, an attacker could unserialize arbitrary objects within FLOW3. To our knowledge it is neither possible to inject code through this vulnerability, nor are there exploitable objects within the FLOW3 Base Distribution. However, there might be exploitable objects within user applications.
CVSS 3.7 · Low · Fix available
- Published
- Updated
Stack: php
Affected products and versions
neos/flow Packagist
- Affected ranges
- ECOSYSTEM: ≥ 1.0.0, < 1.0.4
Update to 1.0.4