CVE-2023-43661CWE-74CWE-94code-injection

CVE-2023-43661

High · published October 12, 2023

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 98.9th percentile for exploit probability.

CVSS v3.1

8.8

EPSS

51%

Percentile

98.9

In the wild

Unconfirmed

What it is

Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.51481 · 98.9th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2023-10-12T00:15Z

Affected products (1)

Product	Versions	Fixed in
all-three/cachet	< 2.4	2.4

References (4)

https://github.com/cachethq/cachet/commit/6fb043e109d2a262ce3974e863c54e9e5f5e0587 · [email protected]https://github.com/cachethq/cachet/security/advisories/GHSA-hv79-p62r-wg3p · [email protected]https://github.com/cachethq/cachet/commit/6fb043e109d2a262ce3974e863c54e9e5f5e0587 · af854a3a-2127-422b-91ae-364da2661108 https://github.com/cachethq/cachet/security/advisories/GHSA-hv79-p62r-wg3p · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

11 OCT 19:56Z
Cachet vulnerable to Authenticated Remote Code Execution
cvelistv5