SS-2015-024: Queued jobs serialised data exposure

November 23, 2015

SavedJobData and SavedJobMessages contain php serialized data. There’s no point showing these to a CMS Admin as they’re not human readable. Worse, it might be insecure, as a malicious CMS Admin might be able to craft a payload thats dangerous to unserialize. This issue has been resolved by hiding this content, even from administrators.

References

www.silverstripe.org/download/security-releases/SS-2015-024

Code Behaviors & Features

Detect and mitigate SS-2015-024 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →