CVE-2023-30179 — Code Injection in CMS

CWE-94 — Code Injection3 documents3 sources
Severity
7.2HIGHNVD
EPSS
5.5%
top 9.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Craftcms CMSCraftcms Craft CMS
Timeline
PublishedJun 13

Description

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶Packagistcraftcms/cms< 4.4.2
▶NVDcraftcms/craft_cms3.7.59

🔴Vulnerability Details

2
CVEList
CVE-2023-30179: CraftCMS version 3↗2023-06-13
▶
GHSA
Withdrawn Advisory: CraftCMS Server-Side Template Injection vulnerability↗2023-06-13
▶
CVE-2023-30179 — Code Injection in Craftcms CMS | cvebase