craftcms/cms Security Advisories for 4.0.0-RC2 (21)
-
[HIGH] Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
PKSA-xh7q-jwpn-v1cd CVE-2024-56145 GHSA-2p6p-9rc9-62j9
Affected version: >=3.0.0,<3.9.14|>=4.0.0-RC1,<4.13.2|>=5.0.0-RC1,<5.5.2
Reported by:
GitHub -
[HIGH] Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
PKSA-4wwj-2m42-9pp5 CVE-2024-52293 GHSA-f3cw-hg6r-chfv
Affected version: >=5.0.0-RC1,<=5.4.2|>=4.0.0-RC1,<=4.12.1
Reported by:
GitHub -
[HIGH] Craft CMS Arbitrary System File Read
PKSA-jkbm-w624-yb7q CVE-2024-52292 GHSA-cw6g-qmjq-6w2w
Affected version: >=3.5.13,<=4.12.6.1|>=5.0.0-alpha.1,<=5.4.7.1
Reported by:
GitHub -
[HIGH] Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
PKSA-mtjx-x487-29s9 CVE-2024-52291 GHSA-jrh5-vhr9-qh7q
Affected version: >=4.0.0-RC1,<=4.12.4.1|>=5.0.0-RC1,<=5.4.5.1
Reported by:
GitHub -
[MEDIUM] Craft CMS Feed-Me
PKSA-yq9g-7wmy-ph9w CVE-2023-36260 GHSA-6p78-f7h9-6838
Affected version: <4.6.2
Reported by:
GitHub -
[MEDIUM] Craft CMS Privilege Escalation
PKSA-gcgv-38nz-y8bs CVE-2024-21622 GHSA-j5g9-j7r4-6qvx
Affected version: >=3.0.0,<=3.9.5|>=4.0.0-RC1,<=4.5.10
Reported by:
GitHub -
[CRITICAL] Craft CMS Remote Code Execution vulnerability
PKSA-zdwv-2yjx-tdbf CVE-2023-41892 GHSA-4w8r-3xrw-v25g
Affected version: >=4.0.0-RC1,<=4.4.14
Reported by:
GitHub -
[HIGH] Craft CMS vulnerable to Remote Code Execution via validatePath bypass
PKSA-cdfq-1syy-3hcn CVE-2023-40035 GHSA-44wr-rmwq-3phw
Affected version: >=3.0.0,<=3.8.14|>=4.0.0-RC1,<=4.4.14
Reported by:
GitHub -
[MEDIUM] Craft CMS vulnerable to HTML injection
PKSA-htxf-m811-km69 CVE-2023-33495 GHSA-m3v5-gjj9-rg24
Affected version: <=4.4.9
Reported by:
GitHub -
[MEDIUM] Stored cross site scripting in Craft CMS
PKSA-j8mx-rm6f-69pz CVE-2023-2817 GHSA-7x94-jx75-3gh6
Affected version: >=4.0.0-RC1,<4.4.12
Reported by:
GitHub -
[MEDIUM] Craft CMS stored XSS in indexedVolumes
PKSA-xrqk-w2n4-gbx4 CVE-2023-33197 GHSA-6qjx-787v-6pxr
Affected version: >=4.0.0-RC1,<=4.4.5
Reported by:
GitHub -
[MEDIUM] Craft CMS stored XSS in review volume
PKSA-d3nn-kdfd-kcm5 CVE-2023-33196 GHSA-cjmm-x9x9-m2w5
Affected version: >=4.0.0-RC1,<=4.4.6
Reported by:
GitHub -
[LOW] CraftCMS stored XSS in Quick Post widget error message
PKSA-yhf6-73qh-nrcp CVE-2023-33194 GHSA-3wxg-w96j-8hq9
Affected version: >=3.0.0,<=3.8.5|>=4.0.0-RC1,<4.4.6
Reported by:
GitHub -
[HIGH] Craft CMS vulnerable to Remote Code Execution via unrestricted file extension
PKSA-trjg-y1pb-yh98 CVE-2023-32679 GHSA-vqxf-r9ph-cc9c
Affected version: >=4.0.0,<4.4.6
Reported by:
GitHub -
[MEDIUM] craftcms/cms vulnerable to cross site scripting in RSS feed widget
PKSA-wgr5-shk8-4nmh CVE-2023-31144 GHSA-j4mx-98hw-6rv6
Affected version: >=4.0.0,<=4.4.3|>=3.0.0,<=3.8.3
Reported by:
GitHub -
[MEDIUM] Craft CMS Stored Cross-site Scripting Injection Vulnerability
PKSA-y2n7-ny47-ym4h CVE-2023-23927 GHSA-qcrj-6ffc-v7hq
Affected version: >=3.7.24,<3.7.64|>=4.0.0-RC1,<4.3.7
Reported by:
GitHub -
[MEDIUM] Craft CMS Cross-site Scripting vulnerability
PKSA-nm2h-kht2-h3cj CVE-2022-37246 GHSA-f546-v666-559x
Affected version: >=3.7.39,<3.7.51|>=4.0.0-RC1,<4.2.1
Reported by:
GitHub -
[MEDIUM] Craft CMS Cross site Scripting vulnerability
PKSA-1cn6-mp7y-tdn1 CVE-2022-37248 GHSA-wxvf-839f-jqmh
Affected version: >=4.0.0-RC1,<4.2.1
Reported by:
GitHub -
[MEDIUM] Craft CMS Stored Cross-site Scripting in User Addresses Title
PKSA-fjpm-r2z5-3msf CVE-2022-37250 GHSA-8r89-x93x-mjq2
Affected version: >=4.0.0-RC1,<4.2.1
Reported by:
GitHub -
[MEDIUM] Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts
PKSA-hq26-n3zb-ct5n CVE-2022-37251 GHSA-mw37-wx8p-gp45
Affected version: >=4.0.0-RC1,<4.2.1|>=3.7.0-beta.1,<3.7.55.2
Reported by:
GitHub -
[MEDIUM] Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page
PKSA-qn7t-x4ck-qyd5 CVE-2022-37247 GHSA-3cvm-7wrh-qrf9
Affected version: >=4.0.0-RC1,<4.2.1
Reported by:
GitHub