要点
- CVE-2023-24676 是影响 processwire/processwire, processwire (processwire) 的高危 (CVSS 7.2)漏洞。
- 未来 30 天内被利用的概率（EPSS）：1.3%，高于 70.7% 的漏洞。
- 暂无已修复版本：请关注参考资料中的厂商公告。
Description
An issue found in Processwire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module.
NVD description
An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a ProcessWire admin is intentionally allowed to install any module that contains any arbitrary code.
processwire/processwire 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free