CVE-2019-16774 - Object injection in cookie driver

CRITICAL

Object injection in cookie driver

Published Dec 12, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.23%

In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
< 5.1.3	affected	<5.1.3

No remediation recorded yet.

Weaknesses (2)

CWE-502

Deserialization of Untrusted Data

CWE-94

Code Injection

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0775		Advisory
https://github.com/PHPSocialNetwork/phpfastcache/commit/c4527205cb7a402b595790c74310791f5b04a1a4		x_refsource_MISCPatchThird Party Advisory
https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13		x_refsource_MISCRelease NotesThird Party Advisory
https://github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-484f-743f-6jx2		x_refsource_CONFIRMThird Party Advisory
https://github.com/advisories/GHSA-484f-743f-6jx2		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16774