164 lines
6.7 KiB
JSON
164 lines
6.7 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-59081",
|
||
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "CERT-PL",
|
||
"dateReserved": "2026-07-02T08:57:58.309Z",
|
||
"datePublished": "2026-11-13T07:29:04.031Z",
|
||
"dateUpdated": "2026-11-13T19:33:42.847Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
|
||
"shortName": "CERT-PL",
|
||
"dateUpdated": "2026-11-13T07:29:04.031Z"
|
||
},
|
||
"title": "Deserialization of untrusted data in Edito CMS",
|
||
"datePublic": "2026-11-12T10:01:00.000Z",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"cweId": "CWE-502",
|
||
"description": "CWE-502 Deserialization of untrusted data",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "Edito",
|
||
"product": "Edito CMS",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "0",
|
||
"lessThan": "5.10.2607",
|
||
"versionType": "semver"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.\n\n\n\n\nThis issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<p>Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server.</p>\n<p>This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.</p>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://cert.pl/posts/2026/07/CVE-2026-59081"
|
||
},
|
||
{
|
||
"url": "https://www.edito.pl/"
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
],
|
||
"cvssV4_0": {
|
||
"attackVector": "LOCAL",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "NONE",
|
||
"privilegesRequired": "HIGH",
|
||
"userInteraction": "NONE",
|
||
"vulnConfidentialityImpact": "HIGH",
|
||
"subConfidentialityImpact": "LOW",
|
||
"vulnIntegrityImpact": "HIGH",
|
||
"subIntegrityImpact": "LOW",
|
||
"vulnAvailabilityImpact": "HIGH",
|
||
"subAvailabilityImpact": "LOW",
|
||
"exploitMaturity": "NOT_DEFINED",
|
||
"Safety": "NOT_DEFINED",
|
||
"Automatable": "NOT_DEFINED",
|
||
"Recovery": "NOT_DEFINED",
|
||
"valueDensity": "NOT_DEFINED",
|
||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||
"providerUrgency": "NOT_DEFINED",
|
||
"version": "4.0",
|
||
"baseSeverity": "HIGH",
|
||
"baseScore": 8.4,
|
||
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"
|
||
}
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Michał Majchrowicz (AFINE Team)",
|
||
"type": "finder"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"value": "Dawid Małecki (AFINE Team)",
|
||
"type": "finder"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"value": "Paweł Zdunek (AFINE Team)",
|
||
"type": "finder"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"x_generator": {
|
||
"engine": "Vulnogram 1.0.3"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-11-13T19:28:41.220251Z",
|
||
"id": "CVE-2026-59081",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-11-13T19:33:42.847Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |