Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities found for phpMussel by phpMussel

    CVE-2020-4043 (GCVE-0-2020-4043)

    Vulnerability from cvelistv5 – Published: 2020-06-10 19:40 – Updated: 2024-08-04 07:52
    VLAI
    Title
    Phar unserialization vulnerability in phpMussel
    Summary
    phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don't use PHP's phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0.
    Severity
    7.7 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    References
    Impacted products
    Vendor Product Version
    phpMussel phpMussel Affected: >= 1.0.0, < 1.6.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:52:20.782Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/phpMussel/phpMussel/security/advisories/GHSA-qr95-4mq5-r3fh"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/phpMussel/phpMussel/issues/167"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/phpMussel/phpMussel/pull/173"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/phpMussel/phpMussel/commit/97f25973433921c1f953430f32d3081adc4851a4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/phpMussel/phpMussel/security/policy#currently-known-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "phpMussel",
          "vendor": "phpMussel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP\u0027s phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don\u0027t use PHP\u0027s phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-10T19:40:15.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/phpMussel/phpMussel/security/advisories/GHSA-qr95-4mq5-r3fh"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpMussel/phpMussel/issues/167"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpMussel/phpMussel/pull/173"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpMussel/phpMussel/commit/97f25973433921c1f953430f32d3081adc4851a4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpMussel/phpMussel/security/policy#currently-known-vulnerabilities"
        }
      ],
      "source": {
        "advisory": "GHSA-qr95-4mq5-r3fh",
        "discovery": "UNKNOWN"
      },
      "title": "Phar unserialization vulnerability in phpMussel",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-4043",
          "STATE": "PUBLIC",
          "TITLE": "Phar unserialization vulnerability in phpMussel"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "phpMussel",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 1.0.0, \u003c 1.6.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "phpMussel"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP\u0027s phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don\u0027t use PHP\u0027s phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-502: Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/phpMussel/phpMussel/security/advisories/GHSA-qr95-4mq5-r3fh",
              "refsource": "CONFIRM",
              "url": "https://github.com/phpMussel/phpMussel/security/advisories/GHSA-qr95-4mq5-r3fh"
            },
            {
              "name": "https://github.com/phpMussel/phpMussel/issues/167",
              "refsource": "MISC",
              "url": "https://github.com/phpMussel/phpMussel/issues/167"
            },
            {
              "name": "https://github.com/phpMussel/phpMussel/pull/173",
              "refsource": "MISC",
              "url": "https://github.com/phpMussel/phpMussel/pull/173"
            },
            {
              "name": "https://github.com/phpMussel/phpMussel/commit/97f25973433921c1f953430f32d3081adc4851a4",
              "refsource": "MISC",
              "url": "https://github.com/phpMussel/phpMussel/commit/97f25973433921c1f953430f32d3081adc4851a4"
            },
            {
              "name": "https://github.com/phpMussel/phpMussel/security/policy#currently-known-vulnerabilities",
              "refsource": "MISC",
              "url": "https://github.com/phpMussel/phpMussel/security/policy#currently-known-vulnerabilities"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-qr95-4mq5-r3fh",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-4043",
    "datePublished": "2020-06-10T19:40:15.000Z",
    "dateReserved": "2019-12-30T00:00:00.000Z",
    "dateUpdated": "2024-08-04T07:52:20.782Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2020-4043 (GCVE-0-2020-4043)

    Vulnerability from nvd – Published: 2020-06-10 19:40 – Updated: 2024-08-04 07:52
    VLAI
    Title
    Phar unserialization vulnerability in phpMussel
    Summary
    phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don't use PHP's phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0.
    Severity
    7.7 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
    CWE
    • CWE-502 - Deserialization of Untrusted Data
    Assigner
    References
    Impacted products
    Vendor Product Version
    phpMussel phpMussel Affected: >= 1.0.0, < 1.6.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:52:20.782Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/phpMussel/phpMussel/security/advisories/GHSA-qr95-4mq5-r3fh"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/phpMussel/phpMussel/issues/167"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/phpMussel/phpMussel/pull/173"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/phpMussel/phpMussel/commit/97f25973433921c1f953430f32d3081adc4851a4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/phpMussel/phpMussel/security/policy#currently-known-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "phpMussel",
          "vendor": "phpMussel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP\u0027s phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don\u0027t use PHP\u0027s phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-10T19:40:15.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/phpMussel/phpMussel/security/advisories/GHSA-qr95-4mq5-r3fh"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpMussel/phpMussel/issues/167"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpMussel/phpMussel/pull/173"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpMussel/phpMussel/commit/97f25973433921c1f953430f32d3081adc4851a4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/phpMussel/phpMussel/security/policy#currently-known-vulnerabilities"
        }
      ],
      "source": {
        "advisory": "GHSA-qr95-4mq5-r3fh",
        "discovery": "UNKNOWN"
      },
      "title": "Phar unserialization vulnerability in phpMussel",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-4043",
          "STATE": "PUBLIC",
          "TITLE": "Phar unserialization vulnerability in phpMussel"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "phpMussel",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 1.0.0, \u003c 1.6.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "phpMussel"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP\u0027s phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don\u0027t use PHP\u0027s phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-502: Deserialization of Untrusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/phpMussel/phpMussel/security/advisories/GHSA-qr95-4mq5-r3fh",
              "refsource": "CONFIRM",
              "url": "https://github.com/phpMussel/phpMussel/security/advisories/GHSA-qr95-4mq5-r3fh"
            },
            {
              "name": "https://github.com/phpMussel/phpMussel/issues/167",
              "refsource": "MISC",
              "url": "https://github.com/phpMussel/phpMussel/issues/167"
            },
            {
              "name": "https://github.com/phpMussel/phpMussel/pull/173",
              "refsource": "MISC",
              "url": "https://github.com/phpMussel/phpMussel/pull/173"
            },
            {
              "name": "https://github.com/phpMussel/phpMussel/commit/97f25973433921c1f953430f32d3081adc4851a4",
              "refsource": "MISC",
              "url": "https://github.com/phpMussel/phpMussel/commit/97f25973433921c1f953430f32d3081adc4851a4"
            },
            {
              "name": "https://github.com/phpMussel/phpMussel/security/policy#currently-known-vulnerabilities",
              "refsource": "MISC",
              "url": "https://github.com/phpMussel/phpMussel/security/policy#currently-known-vulnerabilities"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-qr95-4mq5-r3fh",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-4043",
    "datePublished": "2020-06-10T19:40:15.000Z",
    "dateReserved": "2019-12-30T00:00:00.000Z",
    "dateUpdated": "2024-08-04T07:52:20.782Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}