Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1ydzgyLW1obXgtZ3Jtas4AA3Hr
Guest Entries Remote code execution via file uploads
Impact
When using the file uploads feature, it was possible to upload PHP files.
Patches
The vulnerability is fixed in v3.1.2.
Permalink: https://github.com/advisories/GHSA-rw82-mhmx-grmjJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ydzgyLW1obXgtZ3Jtas4AA3Hr
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 14 days ago
Updated: 13 days ago
CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-rw82-mhmx-grmj, CVE-2023-47621
References:
- https://github.com/duncanmcclean/guest-entries/security/advisories/GHSA-rw82-mhmx-grmj
- https://nvd.nist.gov/vuln/detail/CVE-2023-47621
- https://github.com/duncanmcclean/guest-entries/commit/a8e17b4413bfbbc337a887761a6c858ef1ddb4da
- https://github.com/advisories/GHSA-rw82-mhmx-grmj
Affected Packages
packagist:doublethreedigital/guest-entries
Versions: < 3.1.2Fixed in: 3.1.2
packagist:duncanmcclean/guest-entries
Versions: < 3.1.2Fixed in: 3.1.2