PT-2023-18795 · Ellislab · Expressionengine

Karezma · Publicado 2023-02-09 · Atualizado 2023-03-03 · CVE-2023-22953

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ExpressionEngine versions prior to 7.2.6

Description The issue allows remote code execution by an authenticated Control Panel user.

Recommendations For versions prior to 7.2.6, update to version 7.2.6 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2023-22953

Produtos afetados

Expressionengine

Referências · 8

• https://gist.github.com/ahmedsherif/7b8f18a54a80ae0ac5ff6307c35b7d43 · Nota
• https://t.me/cibsecurity/57822 · Publicação no Telegram
• https://t.me/cvenotify/43993 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22953 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22953 · Nota
• https://osv.dev/vulnerability/CVE-2023-22953 · Aviso do Fabricante
• https://hackerone.com/reports/1820492 · Nota
• https://docs.expressionengine.com/latest/installation/changelog.html · Nota