PT-2024-25915 · Zenario+1 · Zenario+1

Larchik · Published 2024-05-04 · Updated 2024-07-03 · CVE-2024-34461

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zenario versions prior to 9.5.60437

Description The issue is related to the insecure use of Twig filters in the Twig Snippet plugin and in the site-wide HEAD and BODY elements, allowing code execution by a designer or an administrator.

Recommendations For versions prior to 9.5.60437, update to version 9.5.60437 or later to resolve the issue. As a temporary workaround, consider restricting access to the Twig Snippet plugin and the site-wide HEAD and BODY elements to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-34461

GHSA-HR2R-W6WC-25PV

Affected Products

Twig Snippet Plugin

Zenario

References · 8

• https://osv.dev/vulnerability/GHSA-hr2r-w6wc-25pv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34461 · Security Note
• https://github.com/TribalSystems/Zenario · Note
• https://github.com/TribalSystems/Zenario/commit/72afb59da34bace812bffb195d01168a357ff664 · Note
• https://t.me/cvenotify/79102 · Telegram Post
• https://zenar.io/zenario-9/blog/zenario-9560437-patch-released · Note
• https://twitter.com/VulmonFeeds/status/1786709602391740581 · Twitter Post
• https://twitter.com/CVEnew/status/1786770940673560640 · Twitter Post