Description (CNA)
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| craftcms / cms | affected 4.0.0-RC1 before 4.18.3; affected 5.0.0-RC1 before 5.10.7 |
CWE
CWE-693
References
- https://www.hckrt.com/hacktivity/HCKRT-8RQQ7K
- https://github.com/craftcms/cms/releases/tag/5.10.7
- https://github.com/craftcms/cms
ADP enrichment
No English description supplied.
No references supplied.