CVEvulnerability

CVE-2023-43661

8.8 HIGH Published 2023-10-11 Modified 2026-10-20 Official page ↗
Status
Modified
Published
2023-10-11
Last modified
2026-10-20
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
9.1 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Weaknesses
CWE-74, CWE-94

Description

Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.

Affected configurations

• all-three cachet (< 2.4)

Related

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-94 Improper Control of Generation of Code weakness

References