요약
- CVE-2023-47129은(는) statamic/cms, statamic (statamic)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 1.1%, 전체 취약점의 66.2%보다 높음.
- 조치: 4.33.0, 3.4.13 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| statamic/cms Packagist | ≥ 4.0.0, < 4.33.0< 3.4.13
| 4.33.03.4.13
|
| statamic | ≥ 4.0.0, < 4.33.0< 3.4.13
| 4.33.03.4.13
|
Description
Impact
On front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded regardless of mime validation rules. This only affects forms using the "Forms" feature and not just any arbitrary form. This does not affect the control panel.
Patches
It has been patched in 3.4.13 and 4.33.0.
NVD description
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free