CVE-2022-39297

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
melisplatform	melis-cms	<= 5.0.0

References

https://github.com/melisplatform/melis-cms/commit/d124b2474699a679a24ec52620cadceb3d4cec11Patch, Third Party Advisory
https://github.com/melisplatform/melis-cms/security/advisories/GHSA-m3m3-6gww-7gj9Third Party Advisory
https://github.com/melisplatform/melis-cms/commit/d124b2474699a679a24ec52620cadceb3d4cec11Patch, Third Party Advisory
https://github.com/melisplatform/melis-cms/security/advisories/GHSA-m3m3-6gww-7gj9Third Party Advisory

Timeline

Published: Oct 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392989.8MelisFront is the engine that displays website hosted on Melis Platform. It deals with showing pages, plugins, URL rewritting, search optimi CVE-2022-392998.1Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypas CVE-2022-39306.5The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of CVE-2022-393008.1node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authenticati CVE-2022-393015.4sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site s CVE-2022-393025.4Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which c CVE-2022-393039.8Ree6 is a moderation bot. This vulnerability allows manipulation of SQL queries. This issue has been patched in version 1.7.0 by using Javas CVE-2022-393044.7ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghins CVE-2022-393059.8Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to CVE-2022-393068.1Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Im CVE-2022-393075.3Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is mad CVE-2022-393085.9GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your pr