PT-2023-33028 · Fief · Fief

Publicado 2023-06-23 · Atualizado 2023-06-23

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fief (affected versions not specified)

Description The issue is related to Server-Side Template Injection (SSTI), a vulnerability within application templating engines where user input is improperly handled and embedded into the template, possibly leading to code execution. An attacker can use SSTI to execute code on the underlying system by manipulating values within the embedded template. This can allow an attacker to run permissioned commands under the exploited process or exploit Cross-Site Scripting (XSS) to run code within the user's browser. SSTI can lead to reputational damage for the business due to a loss in confidence and trust by users, and if an attacker successfully executes code within the underlying system, it can result in data theft and indirect financial losses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

GHSA-HJ8M-9FHF-V7JP

Produtos afetados

Fief

Referências · 5

• https://github.com/fief-dev/fief/releases/tag/v0.25.3 · Nota
• https://github.com/fief-dev/fief · Nota
• https://github.com/fief-dev/fief/security/advisories/GHSA-hj8m-9fhf-v7jp · Nota
• https://github.com/fief-dev/fief/commit/91e56625b641fa419e2985772266774bae18382b · Nota
• https://osv.dev/vulnerability/GHSA-hj8m-9fhf-v7jp · Aviso do Fabricante