Detections
Analytics
SCA: security update for craftcms/cms (GHSA-4w8r-3xrw-v25g)
critical Tenable Cloud Security Plugin ID 410439
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack
vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version
to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15. (CVE-2023-41892)
See Also
Plugin Details
Severity: Critical
ID: 410439
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.49
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-41892
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/13/2023
Vulnerability Publication Date: 9/13/2023
Exploitable With
Metasploit (Craft CMS unauthenticated Remote Code Execution (RCE))
Reference Information
CVE: CVE-2023-41892
cwe: CWE-94