PT-2024-36473 · Unknown · Getsimple Cms

Published 2024-12-16 · Updated 2024-12-17 · CVE-2024-55085

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GetSimple CMS CE version 3.3.19

Description The issue concerns arbitrary code execution in the template editing function within the background management system. This can be exploited by an attacker to implement Remote Code Execution (RCE).

Recommendations For GetSimple CMS CE version 3.3.19, as a temporary workaround, consider disabling the template editing feature in the background management system until a patch is available. Restrict access to the template editing function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-55085

Affected Products

Getsimple Cms

References · 8

• https://osv.dev/vulnerability/CVE-2024-55085 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55085 · Security Note
• https://tasteful-stamp-da4.notion.site/CVE-2024-55085-15b1e0f227cb80a5aee6faeb820bf7e6 · Note
• https://t.me/cvenotify/104473 · Telegram Post
• https://t.me/cvedetector/13052 · Telegram Post
• https://getsimple-ce.ovh · Note
• https://twitter.com/CVEnew/status/1868790788408136010 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1868917562622222828 · Twitter Post