CVE-2022-38352
published 2022-09-15CVE-2022-38352: ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
20.20%
97.1th percentile
ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| thinkphp | thinkphp | — | — |
| topthink | framework | 0 – 6.0.13 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ThinkPHP deserialization vulnerability
ghsa·2022-09-16
CVE-2022-38352 [CRITICAL] CWE-502 ThinkPHP deserialization vulnerability
ThinkPHP deserialization vulnerability
ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component `League\Flysystem\Cached\Storage\Psr6Cache`. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
OSV
ThinkPHP deserialization vulnerability
osv·2022-09-16
CVE-2022-38352 [CRITICAL] ThinkPHP deserialization vulnerability
ThinkPHP deserialization vulnerability
ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component `League\Flysystem\Cached\Storage\Psr6Cache`. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-15
Published