PT-2023-5849 · Craft Cms · Craft Cms

Zonia3000 · Published 2023-09-13 · Updated 2025-12-26 · CVE-2023-41892

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 4.4.15

Description This is a high-impact, low-complexity attack vector. Craft CMS is a platform for creating digital experiences. The issue is related to improper code generation control, which can allow a remote attacker to execute arbitrary code. About 1,299 results were found using the ZoomEyeDork app:"Craft CMS".

Recommendations To mitigate the issue, update to at least Craft CMS version 4.4.15. Additionally, refresh your security key by running the php craft setup/security-key command and update the CRAFT SECURITY KEY environment variable in all production environments. Consider refreshing other private keys stored as environment variables. As a precaution, force all users to reset their passwords by running php craft resave/users --set passwordResetRequired --to "fn() => true".

Exploit

Fix

Code Injection

Special Elements Injection

Improper Neutralization

Weakness Enumeration

CWE-94

CWE-74

CWE-707

Related Identifiers

BDU:2023-06536

CVE-2023-41892

GHSA-4W8R-3XRW-V25G

Affected Products

Craft Cms

References · 45

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/craftcms_unauth_rce_cve_2023_41892.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41892.json · Exploit
• 🔥 https://github.com/Faelian/CraftCMS_CVE-2023-41892 · Exploit
• 🔥 https://github.com/0xfalafel/CraftCMS_CVE-2023-41892 · Exploit
• 🔥 https://github.com/zaenhaxor/CVE-2023-41892 · Exploit
• 🔥 https://github.com/diegaccio/Craft-CMS-Exploit · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g · Vendor Advisory
• https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476 · Patch
• https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1 · Patch
• https://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e · Patch
• https://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-41892 · Security Note
• https://bdu.fstec.ru/vul/2023-06536 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41892 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4w8r-3xrw-v25g · Vendor Advisory