CVE-2023-41892: Craft CMS Remote Code Execution vulnerability
Summary
CVE-2023-41892: Craft CMS Remote Code Execution vulnerability. Affects craftcms/cms versions >= 4.0.0-RC1, < 4.4.15. Fixed in 4.4.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is an open-source content management system that allows users to create and manage websites. It provides a flexible and customizable platform for developers and content creators. Craft CMS versions before 4.4.15 are affected by a remote code execution vulnerability.
Vulnerability Detail
The remote code execution vulnerability in Craft CMS allows an attacker to execute arbitrary code on the server. This can lead to unauthorized access, data breaches, and potential compromise of the entire system. The vulnerability is considered high-impact and has a CVSS score of 10.0.
How To Fix
Minimum fixed version
4.4.15
This is the first release that contains the fix.
composer require craftcms/cms:4.4.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Craft CMS versions before 4.4.15 are affected by a critical remote code execution vulnerability. Users should update to at least version 4.4.15 to mitigate the issue. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is an open-source content management system used for creating and managing websites.
A remote code execution vulnerability allows an attacker to execute arbitrary code on a target system, potentially leading to unauthorized access and compromise of the system.
This vulnerability in Craft CMS can result in unauthorized access, data breaches, and potential compromise of the entire system.
To fix the vulnerability, update your Craft CMS installation to at least version 4.4.15.
No workaround is available for this vulnerability. Updating to the patched version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
