PT-2023-20431 · Unknown · Crafter Studio+1

Gil Correia · Publicado 2023-02-17 · Atualizado 2023-02-28 · CVE-2023-26020

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CrafterCMS versions 3.1.0 through 3.1.26 CrafterCMS versions 4.0.0 through 4.0.1

Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. The vulnerability affects Crafter Studio on various operating systems and architectures.

Recommendations For CrafterCMS versions 3.1.0 through 3.1.26, update to a version outside of this range to resolve the issue. For CrafterCMS versions 4.0.0 through 4.0.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to sensitive SQL commands to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-26020

Produtos afetados

Crafter Studio

Crafter Cms

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-26020 · Nota de Segurança
• https://t.me/cvenotify/45160 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26020 · Aviso do Fabricante
• https://docs.craftercms.org/en/4.0/security/advisory.html#cv-2023021701 · Aviso do Fabricante
• https://t.me/cibsecurity/58463 · Publicação no Telegram