CVE-2023-43661 | THREATINT

Description

Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.

Reserved 2023-09-20 | Published 2023-10-11 | Updated 2024-09-17 | Assigner GitHub_M

CRITICAL: 9.1CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Problem types

CWE-94: Improper Control of Generation of Code ('Code Injection')

Product status

< 2.4

affected

References

github.com/...cachet/security/advisories/GHSA-hv79-p62r-wg3p

github.com/...ommit/6fb043e109d2a262ce3974e863c54e9e5f5e0587

cve.org (CVE-2023-43661)

nvd.nist.gov (CVE-2023-43661)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.