logo

Database

Server side template injection In craftcms/cms

Description

CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-301302. NVD-2023-301303. OSV-2023-301304. GCVE-2023-30130

References

1. https://craftcms.com2. https://tf1t.gitbook.io/mycve/craftcms/server-site-template-injection-on-craftcms-3.8.1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.