Remote Code Execution (RCE) Affecting statamic/cms package, versions <3.4.13 >=4.0.0, <4.33.0
Threat Intelligence
EPSS
0.07% (31st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-STATAMICCMS-6056188
- published 13 Nov 2023
- disclosed 12 Nov 2023
- credit Cyber-Wo0dy
Introduced: 12 Nov 2023
CVE-2023-47129 Open this link in a new tabHow to fix?
Upgrade statamic/cms to version 3.4.13, 4.33.0 or higher.
Overview
Affected versions of this package are vulnerable to Remote Code Execution (RCE) via the upload feature in the forms. An attacker can upload PHP files crafted to look like images regardless of mime validation rules.
Notes:
This only affects forms using the "Forms" feature and not just any arbitrary form.
This does not affect the control panel.
References
CVSS Scores
version 3.1