GHSA-m2hp-5x78-74mg: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-m2hp-5x78-74mg) is an Insecure Unserialize Vulnerability in FLOW3, discovered and disclosed on March 28, 2012. The issue affects TYPO3/FLOW3 versions 1.0.0 through versions prior to 1.0.4. This moderate severity vulnerability was identified by TYPO3 Security Team Member Helmut Hummel (Neos Blog).

The vulnerability stems from a missing signature (HMAC) for a request argument, which could allow an attacker to unserialize arbitrary objects within FLOW3. The vulnerability has been assigned a suggested CVSS v2.0 score with the following vector: AV:N/AC:H/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C, indicating a moderate severity level (Neos Blog).

While the vulnerability allows for unserialization of arbitrary objects, it was determined that code injection through this vulnerability was not possible within the FLOW3 Base Distribution. However, there remained a potential risk for exploitation through user applications that might contain exploitable objects (GitHub Advisory, Neos Blog).

The vulnerability requires network access and has high attack complexity. According to the CVSS vector, no authentication is required to exploit the vulnerability, though exploitation proof is unproven (Neos Blog).

The vulnerability was patched in FLOW3 version 1.0.4. Users were advised to update to this version to address the security issue. The same issue was also identified in the Extbase Framework in TYPO3, with details provided in advisory TYPO3-CORE-SA-2012-001 (Neos Blog).