CVE-2019-19826

The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demonstrated by PHP object injection, involving a field_names object and an Archive_Tar object, for file deletion. Code execution might also be possible.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
VendorProductVersion
drupalviews_dynamic_field
𝑥
≤ 6.x-1.4
drupalviews_dynamic_field
7.x-1.0:x
drupalviews_dynamic_field
7.x-1.0:x
drupalviews_dynamic_field
7.x-1.0:x
drupalviews_dynamic_field
7.x-1.0:x
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.drupal.org/project/views_dynamic_fields/issues/3056600
https://www.drupal.org/project/views_dynamic_fields/issues/3056600