PT-2023-5849 · Craft Cms · Craft Cms

Zonia3000 · Publicado 2023-09-13 · Atualizado 2025-12-26 · CVE-2023-41892

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 4.4.15

Description This is a high-impact, low-complexity attack vector. Craft CMS is a platform for creating digital experiences. The issue is related to improper code generation control, which can allow a remote attacker to execute arbitrary code. About 1,299 results were found using the ZoomEyeDork app:"Craft CMS".

Recommendations To mitigate the issue, update to at least Craft CMS version 4.4.15. Additionally, refresh your security key by running the php craft setup/security-key command and update the CRAFT SECURITY KEY environment variable in all production environments. Consider refreshing other private keys stored as environment variables. As a precaution, force all users to reset their passwords by running php craft resave/users --set passwordResetRequired --to "fn() => true".

Exploit

Correção

Code Injection

Special Elements Injection

Improper Neutralization

Enumeração de Fraquezas

CWE-94

CWE-74

CWE-707

Identificadores relacionados

BDU:2023-06536

CVE-2023-41892

GHSA-4W8R-3XRW-V25G

Produtos afetados

Craft Cms

Referências · 45

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/craftcms_unauth_rce_cve_2023_41892.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41892.json · Exploit
• 🔥 https://github.com/Faelian/CraftCMS_CVE-2023-41892 · Exploit
• 🔥 https://github.com/0xfalafel/CraftCMS_CVE-2023-41892 · Exploit
• 🔥 https://github.com/zaenhaxor/CVE-2023-41892 · Exploit
• 🔥 https://github.com/diegaccio/Craft-CMS-Exploit · Exploit
• https://github.com/craftcms/cms · Nota
• https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g · Aviso do Fabricante
• https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476 · Correção
• https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1 · Correção
• https://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e · Correção
• https://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857 · Correção
• https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-critical · Nota
• https://twitter.com/HunterMapping/status/1704072843711889904 · Publicação no Twitter
• https://twitter.com/autumn_good_35/status/1702366781380370767 · Publicação no Twitter