Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack
    vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version
    to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15. (CVE-2023-41892)

CraftCMS version 4.x prior to 4.4.15 is vulnerable to a Remote Code Execution (RCE) in the action endpoint.

ID	Name	Product	Family	Severity
410439	SCA: security update for craftcms/cms (GHSA-4w8r-3xrw-v25g)	Tenable Cloud Security	SCA Checks	critical
410439	SCA: security update for craftcms/cms (GHSA-4w8r-3xrw-v25g)	Tenable Self-Hosted Container Security	SCA Checks	critical
114030	CraftCMS 4.x < 4.4.15 Remote Code Execution	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2023-41892

critical

Tenable Plugins

critical

critical

critical