CVE-2021-23592: Deserialization of Untrusted Data

May 6, 2022 (updated May 16, 2022)

The package topthink/framework before 6.0.12 is vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.

References

github.com/top-think/framework/commit/d3b5aeae94bc71bae97977d05cd12c3e0550905c
github.com/top-think/framework/releases/tag/v6.0.12
nvd.nist.gov/vuln/detail/CVE-2021-23592
snyk.io/vuln/SNYK-PHP-TOPTHINKFRAMEWORK-2385695

Code Behaviors & Features

Detect and mitigate CVE-2021-23592 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →