CVE-2018-19907

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/E...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Références

report github.com
web medium.com