CVE-2023-30145: Server-Side Template Injection in… – CVSS 9.8 · Watchpost

← All vulnerabilities

Server-Side Template Injection in Camaleon CMS

严重 9.8CVE-2023-30145 · GHSA-x487-866m-p8hr · Published 26/05/2023 · updated 17/06/2026

要点

CVE-2023-30145 是影响 camaleon_cms, camaleon cms (tuzitio) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：45.9%，高于 98.8% 的漏洞。
修复：升级到 2.7.4 或更高版本。

Package	Affected versions	Patched versions
camaleon_cms RubyGems	`< 2.7.4`	`2.7.4`
camaleon cms tuzitio	`≤ 2.7.0`	No fix yet

Description

Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

NVD description

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

References

nvd.nist.gov/vuln/detail/CVE-2023-30145 · ADVISORY
owen2345/camaleon-cms · WEB
owen2345/camaleon-cms commit 4485788 · WEB
book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection · WEB
drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view · WEB
owen2345/camaleon-cms · PACKAGE
owen2345/camaleon-cms release 2.7.4 · WEB
paragbagul111/CVE-2023-30145 · WEB
rubysec/ruby-advisory-db · WEB
portswigger.net/research/server-side-template-injection · WEB
packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html

camaleon_cms 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free