What is GHSA-mhj4-vrcv-x4xc?

GHSA-mhj4-vrcv-x4xc is a security advisory published by GitHub Security Advisories with High severity. nukeviet Deserialization of Untrusted Data vulnerability

Which CVE IDs does GHSA-mhj4-vrcv-x4xc cover?

GHSA-mhj4-vrcv-x4xc covers the following CVE IDs: CVE-2024-36528. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mhj4-vrcv-x4xc?

GHSA-mhj4-vrcv-x4xc has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mhj4-vrcv-x4xc?

GHSA-mhj4-vrcv-x4xc affects 1 product, including: composer/nukeviet/nukeviet:\u003c= 4.5.

GHSA-mhj4-vrcv-x4xcHighCVSS 8.8

nukeviet Deserialization of Untrusted Data vulnerability

Vendor

GitHub Security Advisories

Published

June 10, 2024

Last Modified

August 21, 2024

🔗 CVE IDs covered (1)

CVE-2024-36528 →

📋 Description

nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php.

🎯 Affected products1

composer/nukeviet/nukeviet:<= 4.5

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-36528
https://mat4mee.notion.site/2-bug-chains-in-nukeViet-lead-to-RCE-bdd42b20b05a448fbe87c752b41bb15f
https://github.com/advisories/GHSA-mhj4-vrcv-x4xc