CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Preserve Code Formatting: from n/a through <= 4.0.1.
Explanation of Vulnerability in Simple Terms
Preserve Code Formatting versions 4.0.1 and earlier contain a deserialization vulnerability that allows authenticated users to execute arbitrary code on the site. An attacker with low-level access can craft malicious serialized data to trigger code execution. This affects all installations running the vulnerable versions.
What an attacker can do
Run arbitrary code on the site with the privileges of the web server.
Potential impact on your site
Any authenticated user can compromise the entire site, including database access and file system control.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
