CVE-2014-3990 Deserialization in n/a
Remote attackers can execute arbitrary code or perform SSRF/XXE attacks via crafted serialized PHP objects in the cart update request.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-3990?
CVE-2014-3990 is a critical unsafe deserialization vulnerability in n/a, published on 20 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.
Which versions are affected by CVE-2014-3990?
It affects 1 product.
Products include Opencart Opencart.
How do I fix CVE-2014-3990?
No fix has been published for CVE-2014-3990 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2014-3990 being exploited?
There is no known exploitation of CVE-2014-3990 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7mhh-43p3-3rjq.