CVE-2019-12799: High severity shopware vulnerability
In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-12799?
CVE-2019-12799 is a vulnerability in Shopware through version 5.6.x that allows for arbitrary deserialization and remote code execution.
How does CVE-2019-12799 impact Shopware?
CVE-2019-12799 allows an attacker to trigger a PHP object instantiation vulnerability, leading to arbitrary deserialization and potential remote code execution in Shopware versions 5.6.x and below.
What is the severity of CVE-2019-12799?
CVE-2019-12799 has a severity rating of 8.8 (high).
How can I fix CVE-2019-12799 in Shopware?
To fix CVE-2019-12799 in Shopware, it is recommended to upgrade to a version above 5.6.x, where the vulnerability has been patched.
Are there any references available for CVE-2019-12799?
Yes, you can find additional information about CVE-2019-12799 in the following references: [Link 1](https://nvd.nist.gov/vuln/detail/CVE-2019-12799), [Link 2](https://github.com/rapid7/metasploit-framework/pull/11828), [Link 3](https://github.com/advisories/GHSA-6m27-7cqj-2mxw)