// For flags

CVE-2019-19373

Squiz Matrix CMS 5.5.x.x Code Execution / Information Disclosure

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can trigger arbitrary unserialization of a PHP object from a packages/cms/page_templates/page_remote_content/page_remote_content.inc POST parameter during processing of a Remote Content page type. This unserialization can be used to trigger the inclusion of arbitrary files on the filesystem (local file inclusion), and results in remote code execution.

Se detectó un problema en Squiz Matrix CMS versiones 5.5.0 anteriores a 5.5.0.3, versiones 5.5.1 anteriores a 5.5.1.8, versiones 5.5.2 anteriores a 5.5.2.4 y versiones 5.5.3 anteriores a 5.5.3.3, donde un usuario puede activar una deserialización arbitrariamente de un objeto PHP desde un parámetro POST del archivo packages/cms/page_templates/page_remote_content/page_remote_content.inc durante el procesamiento de un tipo de página Remote Content. Esta deserialización puede ser usada para activar la inclusión de archivos arbitrarios sobre el sistema de archivos (inclusión de archivos locales) y resultando una ejecución de código remota.

Squiz Matrix CMS suffers from PHP unserialization code execution, information disclosure, and arbitrary file deletion vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-11-28 CVE Reserved
  • 2019-12-11 CVE Published
  • 2024-06-23 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Squiz
Search vendor "Squiz"
 Matrix
Search vendor "Squiz" for product "Matrix"
 >= 5.5.0.0 < 5.5.0.3
Search vendor "Squiz" for product "Matrix" and version " >= 5.5.0.0 < 5.5.0.3"
-
Affected
Squiz
Search vendor "Squiz"
 Matrix
Search vendor "Squiz" for product "Matrix"
 >= 5.5.1.0 < 5.5.1.8
Search vendor "Squiz" for product "Matrix" and version " >= 5.5.1.0 < 5.5.1.8"
-
Affected
Squiz
Search vendor "Squiz"
 Matrix
Search vendor "Squiz" for product "Matrix"
 >= 5.5.2.0 < 5.5.2.4
Search vendor "Squiz" for product "Matrix" and version " >= 5.5.2.0 < 5.5.2.4"
-
Affected
Squiz
Search vendor "Squiz"
 Matrix
Search vendor "Squiz" for product "Matrix"
 >= 5.5.3.0 < 5.5.3.3
Search vendor "Squiz" for product "Matrix" and version " >= 5.5.3.0 < 5.5.3.3"
-
Affected