PT-2023-30735 · Statamic · Statamic

Ahinkle · Publicado 2023-11-14 · Atualizado 2023-11-22 · CVE-2023-48217

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 3.4.14 Statamic versions prior to 4.34.0

Description The issue allows malicious users to upload and execute code by uploading PHP files crafted to look like images, bypassing mime type validation rules. This affects front-end forms using the "Forms" feature and asset upload fields in the control panel.

Recommendations For versions prior to 3.4.14, upgrade to version 3.4.14 or later. For versions prior to 4.34.0, upgrade to version 4.34.0 or later.

Exploit

Correção

Unrestricted File Upload

Code Injection

Enumeração de Fraquezas

CWE-434

CWE-94

Identificadores relacionados

CVE-2023-48217

GHSA-2R53-9295-3M86

Produtos afetados

Statamic

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48217.json · Exploit
• https://github.com/statamic/cms · Nota
• https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411 · Correção
• https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86 · Aviso do Fabricante
• https://github.com/statamic/cms/releases/tag/v4.34.0 · Nota
• https://github.com/statamic/cms/commit/da28afde818d605179fbb63b96eabafabad876b6 · Nota
• https://github.com/statamic/cms/releases/tag/v3.4.14 · Nota
• https://github.com/statamic/cms/pull/8992 · Nota
• https://github.com/statamic/cms/pull/8991 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-48217 · Nota de Segurança
• https://t.me/latest_high_impact_cve/93 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-2r53-9295-3m86 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-48217 · Aviso do Fabricante