CVE-2023-30179

Summary

CVE-2023-30179 is a Server-Side Template Injection (SSTI) vulnerability affecting CraftCMS version 3.7.59. An authenticated attacker can exploit this vulnerability by injecting Twig Templates into the User Photo Location field during user settings modification. If successful, this can result in Remote Code Execution. However, it's important to note that the vendor disputes the potential severity of this issue due to the restricted access to the feature, which is only available to administrators by default.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.