Description

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution.

Remediation

References

CVE-2023-30179

Related Vulnerabilities

SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-0930)

Oracle Database Server CVE-2006-1874 Vulnerability (CVE-2006-1874)

WordPress Plugin Availability Calendar Cross-Site Scripting (1.2.1)

WordPress Plugin Visualizer:Tables and Charts Manager for WordPress Cross-Site Scripting (3.9.4)

phpMyAdmin Improper Input Validation Vulnerability (CVE-2011-0986)

Severity

High

Classification

CVE-2023-30179 CWE-94 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities