CVE-2019-9057: High severity simple cms vulnerability
Published Mar 26, 2019
·Updated
An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection.
Affected Software
1 affected component
CMSmadesimple CMS Made Simple<=2.2.8
Event History
Mar 26, 2019
CVE Published
via MITRE·04:34 PM
Data Sourced
via MITRE·04:34 PM
Description
Data Sourced
via NVD·05:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2019-9057?
CVE-2019-9057 is a vulnerability discovered in CMS Made Simple 2.2.8 that allows for authenticated object injection through an unserialize call with an untrusted parameter in the FilePicker module.
2
How severe is CVE-2019-9057?
CVE-2019-9057 has a severity keyword of 'high' and a severity value of 8.8 out of 10.
3
What software versions are affected by CVE-2019-9057?
CVE-2019-9057 affects all versions up to and including CMS Made Simple 2.2.8.
4
How can I fix CVE-2019-9057?
To fix CVE-2019-9057, upgrade to the latest version of CMS Made Simple (v2.2.10) as recommended by the official CMS Made Simple website.
5
What is the CWE ID for CVE-2019-9057?
The CWE ID for CVE-2019-9057 is CWE-502 and CWE-915.