Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2021-23420

Deserialization of Untrusted Data

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
snyk

Description

This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a codeception/codeception

  • 4.0.0 to < unspecifiedaffected
  • unspecified to < 4.1.22affected
  • unspecified to < 3.1.3affected

References