Vulnerability · Published Aug 23, 2023 · Assigned by GitHub_M

CVE-2023-40035Craft CMS vulnerable to Remote Code Execution via validatePath bypass

High 7.2

In plain English

A high-severity injection in cms from craftcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)2.3%top 16.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	craftcms/cms	4.4.15	GHSA-44wr-rmwq-3phw
Packagist	craftcms/cms	3.8.15	GHSA-44wr-rmwq-3phw

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	>= 4.0.0-RC1, < 4.4.15>= 3.0.0, < 3.8.15

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/craftcms/cms/security/advisories/GHSA-44wr-rmwq-3phw x_refsource_CONFIRM
https://github.com/craftcms/cms/commit/0bd33861abdc60c93209cff03eeee54504d3d3b5 x_refsource_MISC
https://github.com/craftcms/cms/releases/tag/3.8.15 x_refsource_MISC
https://github.com/craftcms/cms/releases/tag/4.4.15 x_refsource_MISC