CVE-2018-20465 — Missing Encryption of Sensitive Data in Craft CMS

CWE-311 — Missing Encryption of Sensitive DataCWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine5 documents5 sources
Severity
7.2HIGHNVD
EPSS
0.7%
top 28.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Craftcms Craft CMSCraftcms CMS
Timeline
PublishedDec 25
Latest updateMay 13

Description

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶Packagistcraftcms/cms3.0.34
▶NVDcraftcms/craft_cms3.0.34

🔴Vulnerability Details

3
GHSA
Craft CMS Vulnerable to Server-Side Template Injection↗2022-05-13
▶
OSV
Craft CMS Vulnerable to Server-Side Template Injection↗2022-05-13
▶
CVEList
CVE-2018-20465: Craft CMS through 3↗2018-12-25
▶

📐Framework References

1
CWE
Improper Neutralization of Special Elements Used in a Template Engine↗
▶
CVE-2018-20465 — Missing Encryption of Sensitive Data | cvebase