CVE-2018-19499 Deserialization in n/a

What is CVE-2018-19499?

CVE-2018-19499 is a high-severity unsafe deserialization vulnerability in n/a, published on 23 Nov 2018. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the Gdn_Format class.

Weakness: CWE-502

Which versions are affected by CVE-2018-19499?

It affects 1 product.

Products include Vanillaforums Vanilla.

How do I fix CVE-2018-19499?

No fix has been published for CVE-2018-19499 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2018-19499 being exploited?

There is no known exploitation of CVE-2018-19499 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2011-3614 Missing authorization in Vanilla Forums Critical 9.8
• CVE-2018-18903 Code injection in n/a Critical 9.8
• CVE-2011-3613 Information disclosure in Vanilla Forums High 7.5
• CVE-2016-10073 Information disclosure in n/a High 7.5
• CVE-2013-3527 SQL injection in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2x7q-53h6-xvhj.