PT-2023-30735 · Statamic · Statamic

Ahinkle · Published 2023-11-14 · Updated 2023-11-22 · CVE-2023-48217

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 3.4.14 Statamic versions prior to 4.34.0

Description The issue allows malicious users to upload and execute code by uploading PHP files crafted to look like images, bypassing mime type validation rules. This affects front-end forms using the "Forms" feature and asset upload fields in the control panel.

Recommendations For versions prior to 3.4.14, upgrade to version 3.4.14 or later. For versions prior to 4.34.0, upgrade to version 4.34.0 or later.

Exploit

Fix

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

CVE-2023-48217

GHSA-2R53-9295-3M86

Affected Products

Statamic

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48217.json · Exploit
• https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411 · Patch
• https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48217 · Security Note
• https://osv.dev/vulnerability/GHSA-2r53-9295-3m86 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48217 · Vendor Advisory
• https://github.com/statamic/cms · Note
• https://github.com/statamic/cms/releases/tag/v4.34.0 · Note
• https://github.com/statamic/cms/commit/da28afde818d605179fbb63b96eabafabad876b6 · Note
• https://github.com/statamic/cms/releases/tag/v3.4.14 · Note
• https://github.com/statamic/cms/pull/8992 · Note
• https://github.com/statamic/cms/pull/8991 · Note
• https://t.me/latest_high_impact_cve/93 · Telegram Post