Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yY3ZnLXcyOW0tajh4Y84AA42s

Arbitrary Code Execution in Processwire

An issue found in Processwire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module.

Permalink: https://github.com/advisories/GHSA-2cvg-w29m-j8xc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yY3ZnLXcyOW0tajh4Y84AA42s
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-2cvg-w29m-j8xc, CVE-2023-24676
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-24676
• https://medium.com/%40cupc4k3/reverse-shell-via-remote-file-inlusion-in-proccesswire-cms-a8fa5ace3255
• https://github.com/advisories/GHSA-2cvg-w29m-j8xc

Blast Radius: 10.4

Affected Packages