CVE-2023-40035

Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/craftcms/cms/commit/0bd33861abdc60c93209cff03eeee54504d3d3b5	Patch
https://github.com/craftcms/cms/releases/tag/3.8.15	Release Notes
https://github.com/craftcms/cms/releases/tag/4.4.15	Release Notes
https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phw	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:craftcms:craft_cms::::::::
	cpe:2.3:a:craftcms:craft_cms::::::::
	cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1::::::

History

No history.

Information

Published : 2023-08-23 21:15

Updated : 2023-08-29 15:24

NVD link : CVE-2023-40035

Mitre link : CVE-2023-40035

CVE.ORG link : CVE-2023-40035

JSON object : View

Products Affected

craftcms

craft_cms

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2023-40035", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2023-08-23T21:15:08.300", "references": [{"url": "https://github.com/craftcms/cms/commit/0bd33861abdc60c93209cff03eeee54504d3d3b5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/craftcms/cms/releases/tag/3.8.15", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/craftcms/cms/releases/tag/4.4.15", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phw", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.\n"}, {"lang": "es", "value": "Craft es un CMS para crear experiencias digitales personalizadas en la web y m\u00e1s all\u00e1. Eludir la funci\u00f3n validatePath puede llevar a una potencial ejecuci\u00f3n remota de c\u00f3digo. Esta vulnerabilidad puede llevar al control malicioso de sistemas vulnerables y a la exfiltraci\u00f3n de datos. Aunque la vulnerabilidad es explotable s\u00f3lo en los usuarios autenticados, configuraci\u00f3n con ALLOW_ADMIN_CHANGES=true, todav\u00eda hay una amenaza potencial de seguridad (Ejecuci\u00f3n remota de c\u00f3digo). Este problema ha sido parcheado en las versiones 4.4.15 y 3.8.15."}], "lastModified": "2023-08-29T15:24:48.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66A86621-3391-446B-B61D-8ED2E91394CB", "versionEndExcluding": "3.8.15", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DB9BEB3-147E-41EE-96CB-957D31321C2D", "versionEndExcluding": "4.4.15", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC2F40FC-7C27-456A-B16D-679410D1D5CF"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}

7.2 /10