Craft CMS 5.0.0 Beta 9

CPE Details

Craft CMS 5.0.0 Beta 9
craftcms
craft_cms
5.0.0
2024-04-02
08h44 +00:00
2024-04-02
08h44 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:craftcms:craft_cms:5.0.0:beta9:*:*:*:*:*:*

Informations

Vendor

craftcms

Product

craft_cms

Version

5.0.0

Update

beta9

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2024-52292 2024-11-13 16h08 +00:00 Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. This is fixed in 5.4.9 and 4.12.8.
7.7
Haute
CVE-2024-45406 2024-09-09 16h46 +00:00 Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.
5.5
Moyen
CVE-2024-41800 2024-07-25 16h12 +00:00 Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.
7.5
Haute