CVE-2023-36825 Vulnerability Details

  /     /     /  

CVE-2023-36825 Metadata Quick Info

CVE Published: 11/07/2023 | CVE Updated: 23/10/2024 | CVE Year: 2023
Source: GitHub_M | Vendor: orchidsoftware | Product: platform
Status : PUBLISHED

---

CVE-2023-36825 Description

Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.

Metrics

CVSS Version: 3.1 | Base Score: 9.7 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* REQUIRED
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-502
CWE Name: CWE-502: Deserialization of Untrusted Data
Source: orchidsoftware

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).