GHSA-2cvg-w29m-j8xc

Source

https://github.com/advisories/GHSA-2cvg-w29m-j8xc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-2cvg-w29m-j8xc/GHSA-2cvg-w29m-j8xc.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-2cvg-w29m-j8xc

Aliases

CVE-2023-24676

Published

2024-01-24T21:30:33Z

Modified

2024-01-30T21:36:54.143182Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Arbitrary Code Execution in Processwire

Details

An issue found in Processwire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the downloadzipurl parameter when installing a new module.

Database specific

{
    "nvd_published_at": "2024-01-24T21:15:08Z",
    "cwe_ids": [
        "CWE-94"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-24T21:54:14Z"
}

References

Affected packages

Packagist / processwire/processwire

Package

Name: processwire/processwire
Purl: pkg:composer/processwire/processwire

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

3.0.210

Affected versions

3.*

3.0.34

3.0.35

3.0.36

3.0.39

3.0.41

3.0.42

3.0.61

3.0.62

3.0.96

3.0.98

3.0.123

3.0.148

3.0.164

3.0.165

3.0.184

3.0.200

3.0.210