CVE-2022-39298: Deserialization of Untrusted Data

October 12, 2022 (updated October 13, 2022)

MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewritting, search optimization and SEO, etc. Attackers can deserialize arbitrary data on affected versions of melisplatform/melis-front, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to melisplatform/melis-front >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.

References

github.com/melisplatform/melis-front/commit/89ae612d5f1f7aa2fb621ee8de27dffe1feb851e
github.com/melisplatform/melis-front/security/advisories/GHSA-h479-2mv4-5c26
nvd.nist.gov/vuln/detail/CVE-2022-39298

Code Behaviors & Features

Detect and mitigate CVE-2022-39298 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →