Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

What to know

What it is

The Marcell application has a critical vulnerability (CVSS 9.8) due to unauthenticated PHP Object Injection in versions up to 1.2.14. An attacker could exploit this to gain high-level privileges, read, modify or delete data, and perform other malicious actions.

Affected

{'products': ['Marcell'], 'packages': [], 'versions': ['<= 1.2.14']}

Fix

Check the linked advisory for a fix, as none is provided here.

Exploitation

No known exploitation