Loading...
Skip to main content
GeekWala

CVE-2023-29689 — Vulnerability in pyrocms/pyrocms — CVE Details

CRITICAL

PyroCMS remote code execution vulnerability

Published August 4, 2023Updated December 3, 2024Source: osv

Summary

PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability allows a malicious attacker to send customized commands to the server and execute arbitrary code on the affected system.

Advisory Timeline

  • First published August 4, 2023 (1165 days ago).
  • Last revised December 3, 2024 — 487 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
pyrocms/pyrocms
packagist
3.0.0-alpha1, 3.0.0-alpha2, 3.4.11, v2.3.0-alpha1 (+60 more)Range-based data available

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-29689?
PyroCMS remote code execution vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2023-29689?
CVE-2023-29689 affects pyrocms/pyrocms. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-29689 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-w7vm-4v3j-vgpw

Related CVEs

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies