VULNERABILITY INTELLIGENCE

CVE-2019-9057

CVSS score8.8 HIGH
EPSS probability1.57%
CISA KEVNot currently listed
Published2019-03-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection.

Weakness classification

  • CWE-502: Deserialization of Untrusted Data
  • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Primary references