CWE Code: 74
Vulnerability Type: privilege_escalation
CVSS Score: 10.0
CWE Name:  Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Summary: in pydio before 8.2.2, an attack is possible via php object injection because a user is allowed to use the $phpserial$a:0:{} syntax to store a preference. an attacker either needs a "public link" of a file, or access to any unprivileged user account for creation of such a link.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-01-15
Last Modified Date: 2019-01-28