7.5

CVE-2019-11458

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cakephp ≫ Cakephp Version3.7.6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.06% 0.788
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:N/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://bakery.cakephp.org/2019/04/23/cakephp_377_3615_3518_released.html
Third Party Advisory
https://github.com/cakephp/cakephp/commit/1a74e798309192a9895c9cedabd714ceee345f4e
Patch
Third Party Advisory
https://github.com/cakephp/cakephp/commits/master
Patch
Third Party Advisory
https://github.com/cakephp/cakephp/compare/3.7.6...3.7.7
Patch
Third Party Advisory
https://github.com/cakephp/cakephp/releases
Third Party Advisory
Release Notes