Description

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution.

Remediation

References

CVE-2023-30179

Related Vulnerabilities

Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3546)

Oracle Database Server CVE-2023-21949 Vulnerability (CVE-2023-21949)

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2009-0499)

Joomla Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2005-4650)

Nginx Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2019-20372)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-94 CVE-2023-30179