VulnerabilityModified
CVE-2023-47129
This only affects forms using the "Forms" feature and not just _any_ arbitrary form.
CRITICAL 9.8EPSS 1.12%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.12% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- statamic/statamic
- Source
- security-advisories@github.com
References
- https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75Patch
- https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77Patch
- https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfcVendor Advisory
- https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75Patch
- https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77Patch
- https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfcVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.