CVE-2023-30179
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Locat...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web datnlq.gitbook.io
- web github.com