Detections
Analytics

SCA: security update for statamic/cms (GHSA-qcgx-7p5f-hxvr)

low Tenable Self-Hosted Container Security Plugin ID 418058

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a
 single character of a user's password hash using a specially crafted regular expression filter in the
 users endpoint of the REST API. Multiple such requests can eventually uncover the entire hash. The hash is
 not present in the response, however the presence or absence of a result confirms if the character is in
 the right position. The API has throttling enabled by default, making this a time intensive task. Both the
 REST API and the users endpoint need to be enabled, as they are disabled by default. The issue has been
 fixed in versions 3.2.39 and above, and 3.3.2 and above. (CVE-2022-24784)

See Also

https://github.com/advisories/GHSA-qcgx-7p5f-hxvr

Plugin Details

Severity: Low

ID: 418058

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2022-24784

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/29/2022

Vulnerability Publication Date: 3/25/2022

Reference Information

CVE: CVE-2022-24784