CVE-2023-30145 — Server-Side Template Injection in camaleon_cms —...
Server-Side Template Injection in Camaleon CMS
Summary
Advisory Timeline
- First published May 26, 2023 (1235 days ago).
- Last revised February 16, 2024 — 266 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
gem install camaleon_cms -v 2.7.4
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (1)
Affects 1 ecosystem: rubygems (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| camaleon_cms | rubygems | 0.0.1, 0.0.2, 0.1.2, 0.1.3 (+105 more) | 2.7.4 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-94Code InjectionMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-30145ADVISORY
- https://github.com/owen2345/camaleon-cms/issues/1052WEB
- https://github.com/owen2345/camaleon-cms/commit/4485788c544eb1aae52ca613bd9626129e3df6eeWEB
- https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injectionWEB
- https://drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view?usp=share_linkWEB
- https://github.com/owen2345/camaleon-cmsPACKAGE
- https://github.com/owen2345/camaleon-cms/releases/tag/2.7.4WEB
- https://github.com/paragbagul111/CVE-2023-30145WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2023-30145.ymlWEB
- https://portswigger.net/research/server-side-template-injectionWEB
- https://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.htmlWEB
Frequently Asked Questions
- What is CVE-2023-30145?
- Server-Side Template Injection in Camaleon CMS This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2023-30145?
- CVE-2023-30145 affects camaleon_cms. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-30145 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2025-2304CRITICAL
Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment
- CVE-2021-25970HIGH
Camaleon CMS Insufficient Session Expiration vulnerability
- GHSA-7x4w-cj9r-h4v9HIGH
Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
- CVE-2024-46987HIGH
Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)
- CVE-2024-46986HIGH
Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)
- CVE-2018-18260MEDIUM
Camaleon CMS vulnerable to Stored Cross-site Scripting
- CVE-2024-48652MEDIUM
camaleon_cms affected by cross site scripting
- CVE-2026-1776MEDIUM
Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies