Description

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution.

Remediation

References

CVE-2023-30179

Related Vulnerabilities

WordPress Plugin Widgets for SiteOrigin Unspecified Vulnerability (1.4.4)

WordPress Plugin GiveWP-Donation and Fundraising Platform Multiple Cross-Site Scripting Vulnerabilities (2.17.2)

Apache Traffic Server CVE-2022-47184 Vulnerability (CVE-2022-47184)

Liferay Portal Missing Authorization Vulnerability (CVE-2022-39975)

WebLogic CVE-2021-2157 Vulnerability (CVE-2021-2157)

Severity

High

Classification

CVE-2023-30179 CWE-94 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities