CVE-2023-46818

Опубликовано: 27 окт. 2023

Источник: nvd

CVSS3: 7.2

EPSS Высокий

Описание

An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled.

Ссылки

http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html
http://seclists.org/fulldisclosure/2023/Dec/2
https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/
Issue Tracking
Patch
Vendor Advisory
http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html
http://seclists.org/fulldisclosure/2023/Dec/2
https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/
Issue Tracking
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ispconfig:ispconfig:*:*:*:*:*:*:*:*

Версия до 3.2.11 (исключая)

cpe:2.3:a:ispconfig:ispconfig:3.2.11:-:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.89116

Высокий

7.2 High

CVSS3

Дефекты

CWE-94

Связанные уязвимости

GHSA-qfc7-gwmc-9vvr