Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1ydzgyLW1obXgtZ3Jtas4AA3Hr

Guest Entries Remote code execution via file uploads

Impact

When using the file uploads feature, it was possible to upload PHP files.

Patches

The vulnerability is fixed in v3.1.2.

Permalink: https://github.com/advisories/GHSA-rw82-mhmx-grmj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ydzgyLW1obXgtZ3Jtas4AA3Hr
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 1 year ago
Updated: about 1 year ago


CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-rw82-mhmx-grmj, CVE-2023-47621
References: Repository: https://github.com/duncanmcclean/guest-entries
Blast Radius: 0.0

Affected Packages

packagist:doublethreedigital/guest-entries
Dependent packages: 0
Dependent repositories: 1
Downloads: 1,326 total
Affected Version Ranges: < 3.1.2
Fixed in: 3.1.2
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 3.0.0, 3.1.0, 3.1.1
All unaffected versions: 3.1.2, 3.1.3, 3.2.0, 4.0.0, 4.0.1
packagist:duncanmcclean/guest-entries
Dependent packages: 0
Dependent repositories: 0
Downloads: 1,871 total
Affected Version Ranges: < 3.1.2
Fixed in: 3.1.2
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 3.0.0, 3.1.0, 3.1.1
All unaffected versions: 3.1.2, 3.1.3, 3.2.0, 4.0.0, 4.0.1