GHSA-gx6v-67qv-rhx5

Source

https://github.com/advisories/GHSA-gx6v-67qv-rhx5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-gx6v-67qv-rhx5/GHSA-gx6v-67qv-rhx5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gx6v-67qv-rhx5

Aliases

CVE-2017-20064

Published

2022-06-21T00:00:48Z

Modified

2023-11-08T03:59:17.199292Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Code injection in Elefant CMS

Details

A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection. The attack can be launched remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.

Database specific

{
    "nvd_published_at": "2022-06-20T05:15:00Z",
    "github_reviewed_at": "2022-06-29T22:09:12Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-94"
    ]
}

References

Affected packages

Packagist / elefant/cms

Package

Name: elefant/cms
Purl: pkg:composer/elefant/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.13