Untrusted Object Deserialisation

2022-06-3009:55:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

58.4%

JSON

topthink/think is vulnerable to untrusted object deserialisation. The vulnerability exists in the AbstractCache function in CacheStore.php which allows an attacker to inject and execute arbitrary code via a crafted payload.

CPENameOperatorVersion
topthink/thinklev6.0.12
topthink/thinklev6.0.12

CPE	Name	Operator	Version
	topthink/think	le	v6.0.12
	topthink/think	le	v6.0.12

References

github.com/advisories/GHSA-g377-x8rg-c9mf

github.com/top-think/framework/blob/v6.0.12/src/think/filesystem/CacheStore.php#L18

github.com/top-think/framework/issues/2717

0.002 Low

EPSS

Percentile

58.4%

JSON

Related for VERACODE:36215