GitHub Advisoryadvisory · Packagist

GHSA-h92m-4g9m-72vr juzawebCMS Injection vulnerability

HIGH Published 2023-10-28 Modified 2024-01-09 Official page ↗
Aliases
CVE-2023-46468
Ecosystem
Packagist
Packages
juzaweb/cms
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2024-01-09

Affected packages

• Packagist juzaweb/cms: <= 3.4 (no fix yet)

Description

An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function.

Related

Alias · CVE (1)

  • CVE-2023-46468 An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References