9.8
CVE-2022-24108
- EPSS 40.64%
- Veröffentlicht 17.05.2022 16:15:09
- Zuletzt bearbeitet 21.11.2024 06:49:49
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginThe Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Skyoftech ≫ So Listing Tabs Version2.2.0 SwPlatformopencart
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 40.64% | 0.972 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-502 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.