HighGHSA-j7fx-v37j-v3w7CVE-2018-20465

Craft CMS Vulnerable to Server-Side Template Injection

Published 13 May 2022 · Updated 25 Apr 2024

Affected package

craftcms/cmsComposer
Affected
<=3.0.34
Fixed in
No fix released

Details

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.

Is GHSA-j7fx-v37j-v3w7 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.