CVE-2023-30179
highPriorität · verfolgen · 30EPSS 0.022 · 82. PerzentilEUUSEPSS · bewertet 2026-10-27
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor disputes this because only Administrators can add this Twig code, and (by design) Administrators are allowed to do that by default.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.6–7.2
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-3x74-v64j-qc3fWithdrawn Advisory: CraftCMS Server-Side Template Injection vulnerability2023-06-13ghsa · osvUS
## Withdrawn This advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references. [According to maintainers of Craft CMS](https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200), only administrators can access Settings, and those administrators may have business needs for their permissions. Additionally, the underlying issue likely has little to no real-world security impact. ## Original Description CraftCMS is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (13)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2023-30179/cnnvd
- https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injectioncnnvd
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14cnnvd
- https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714cnnvd
- https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200cnnvd
- https://datnlq.gitbook.io/cve/craft-cms/cve-2023-30179-server-side-template-injectionenisa_euvd
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#442---2023-03-14enisa_euvd
- https://github.com/github/advisory-database/pull/2443#issuecomment-1610040714enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan