by Kastro
Paper/Archive/CVE-2023-41892

CVE-2023-41892

craftcms cms — Craft CMS Remote Code Execution vulnerability

EPSS 94%CVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 99.8.998 × 2020.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.

Affected

ProductAffectedFixed inSource
cms>= 4.0.0-RC1, <= 4.4.14–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25grefgithub.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857refgithub.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355erefgithub.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1refgithub.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476refgithub.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-criticalrefpacketstormsecurity.com/files/176303/Craft-CMS-4.4.14-Remote-Code-Execution.html