Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1ocjJyLXc2d2MtMjVwds4AA7wE

Zenario uses Twig filters insecurely in the Twig Snippet plugin

Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.

Permalink: https://github.com/advisories/GHSA-hr2r-w6wc-25pv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocjJyLXc2d2MtMjVwds4AA7wE
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 7 months ago
Updated: 5 months ago


CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-hr2r-w6wc-25pv, CVE-2024-34461
References: Repository: https://github.com/TribalSystems/Zenario
Blast Radius: 0.0

Affected Packages

packagist:tribalsystems/zenario
Dependent packages: 1
Dependent repositories: 1
Downloads: 188 total
Affected Version Ranges: < 9.5.60437
Fixed in: 9.5.60437
All affected versions: 7.5.40440, 7.5.41006, 7.5.41499, 7.5.41633, 7.5.42085, 7.5.42990, 7.5.47180, 7.6.41504, 7.6.41633, 7.6.42085, 7.6.42990, 7.6.47180, 7.7.42682, 7.7.42963, 7.7.42990, 7.7.44223, 7.7.47180, 7.7.47369, 7.7.48583, 8.0.44237, 8.0.44273, 8.0.44294, 8.0.44521, 8.0.45032, 8.0.45250, 8.0.45529, 8.0.47180, 8.0.48583, 8.1.45530, 8.1.45698, 8.1.46089, 8.1.46433, 8.1.46615, 8.1.47180, 8.1.47369, 8.1.48583, 8.2.46436, 8.2.46614, 8.2.47180, 8.2.47369, 8.2.47992, 8.2.48583, 8.3.47997, 8.3.48583, 8.3.50564, 8.4.50565, 8.4.51340, 8.5.50567, 8.5.50837, 8.5.51340, 8.6.51342, 8.8.53370, 8.8.53725, 8.8.54063, 8.9.54063, 8.9.54149, 8.9.54153, 8.9.55141, 9.0.54156, 9.0.55141, 9.0.57473, 9.1.55143, 9.1.55510, 9.1.55619, 9.1.57473, 9.2.55826, 9.2.57169, 9.2.57473, 9.3.57186, 9.3.57474, 9.3.57595, 9.3.57709, 9.3.57754, 9.3.58670, 9.4.58686, 9.4.59197, 9.4.59574, 9.4.60437, 9.5.59574, 9.5.59647, 9.5.60240
All unaffected versions: 9.5.60437, 9.5.60602, 9.6.60604, 9.6.60771, 9.6.61188, 9.7.61188