PT-2022-12333 · Statamic · Statamic

Published 2022-02-10 · Updated 2024-08-04 · CVE-2021-45364

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Statamic versions through 3.2.26

Description A Code Execution issue exists via SettingsController.php. However, the vendor indicates that there was an error in publishing this record, and all parties agree that the affected code was not used in any Statamic product.

Recommendations For versions through 3.2.26, consider this issue as a false positive based on the vendor's statement that the affected code was not used in any Statamic product. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but given the vendor's clarification, no action may be required.

Exploit

Fix

Related Identifiers

CVE-2021-45364

Affected Products

Statamic

References · 6

• 🔥 https://github.com/Stakcery/Web-Security/issues/2 · Exploit
• https://osv.dev/vulnerability/CVE-2021-45364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45364 · Security Note
• https://t.me/cvenotify/85058 · Telegram Post
• https://t.me/cvenotify/88931 · Telegram Post
• https://t.me/cibsecurity/37254 · Telegram Post