What is GHSA-8r5j-gm3j-cx9c?

GHSA-8r5j-gm3j-cx9c is a security advisory published by GitHub Security Advisories with High severity. Winter CMS Server-Side Template Injection (SSTI) vulnerability

Which CVE IDs does GHSA-8r5j-gm3j-cx9c cover?

GHSA-8r5j-gm3j-cx9c covers the following CVE IDs: CVE-2024-29686. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8r5j-gm3j-cx9c?

GHSA-8r5j-gm3j-cx9c has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-8r5j-gm3j-cx9c?

GHSA-8r5j-gm3j-cx9c affects 1 product, including: composer/wintercms/winter:\u003c= 1.2.3.

GHSA-8r5j-gm3j-cx9cHighCVSS 8.8

Winter CMS Server-Side Template Injection (SSTI) vulnerability

Vendor

GitHub Security Advisories

Published

March 29, 2024

Last Modified

August 2, 2024

🔗 CVE IDs covered (1)

CVE-2024-29686 →

📋 Description

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components.

🎯 Affected products1

composer/wintercms/winter:<= 1.2.3

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-29686
https://forum.ksec.co.uk/t/webapps-winter-cms-1-2-3-server-side-template-injection-ssti-authenticated/2779
https://www.exploit-db.com/exploits/51893
https://wintercms.com/docs/v1.2/docs/cms/themes#template-structure
https://github.com/advisories/GHSA-8r5j-gm3j-cx9c