Craft CMS 3.8.10.2

CPE Details

Craft CMS 3.8.10.2
craftcms
craft_cms
3.8.10.2
2023-06-01
12h08 +00:00
2023-06-01
15h25 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:craftcms:craft_cms:3.8.10.2:*:*:*:*:*:*:*

Informations

Vendor

craftcms

Product

craft_cms

Version

3.8.10.2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2024-52292 2024-11-13 16h08 +00:00 Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. This is fixed in 5.4.9 and 4.12.8.
7.7
Haute
CVE-2023-36260 2024-01-29 23h00 +00:00 An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security."
7.5
Haute
CVE-2024-21622 2024-01-03 16h51 +00:00 Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
8.8
Haute
CVE-2023-40035 2023-08-23 20h05 +00:00 Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.
7.2
Haute
CVE-2023-33495 2023-06-19 22h00 +00:00 Craft CMS through 4.4.9 is vulnerable to HTML Injection.
6.1
Moyen
CVE-2023-33197 2023-05-26 19h17 +00:00 Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.
5.5
Moyen
CVE-2023-2817 2023-05-25 22h00 +00:00 A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.
5.4
Moyen
CVE-2023-23927 2023-03-03 21h58 +00:00 Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting (XSS) happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7.
6.1
Moyen