{"id":"GHSA-74mf-vjpg-9xh7","aliases":["CVE-2015-2171"],"title":"Slim vulnerable to PHP object injection","description":"Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data.","severity":"high","score":null,"published":"2022-05-17T03:34:17.000Z","modified":"2024-12-08T05:26:43.196Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"slim/slim","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.6.0"}],"type":"ECOSYSTEM"}],"versions":["1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","2.0.0","2.1.0","2.2.0","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0"],"fixed":["2.6.0"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2015-2171","https://github.com/slimphp/Slim/issues/1034","https://github.com/slimphp/Slim/commit/9fa651474eb4d3bb0ce40dd5a55c51bb861c2658","https://github.com/FriendsOfPHP/security-advisories/blob/master/slim/slim/CVE-2015-2171.yaml","https://github.com/slimphp/Slim","https://web.archive.org/web/20200229032229/http://www.securityfocus.com/bid/70087","http://seclists.org/fulldisclosure/2015/Mar/16","http://www.slimframework.com/2015/03/01/version-260.html"],"sources":[{"name":"OSV","id":"GHSA-74mf-vjpg-9xh7","modified":"2024-12-08T05:26:43.196511Z","url":"https://osv.dev/vulnerability/GHSA-74mf-vjpg-9xh7"}],"assessments":[]}