GHSA-x2j7-6hxm-87p3

ghsaUSosv

Craft CMS Remote Code Injection

view advisory published 2021-07-02Licence: CC-BY-4.0

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-27903US	critical9.8OT elevated	2.82% (87th)	—	2021-06-30
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative chan…

references

External citations — patches, advisories, analysis.

https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23WEB
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#securityWEB
https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-27903ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan