CVE-2023-34448

CVSS Score of 10 (low)

Details

Published Jun 14, 2023
Updated: Jun 22, 2023
CWE ID 94
CWE ID 1336
CWE ID 20

Summary

CVE-2023-34448 is a server-side template injection vulnerability in the Grav flat-file content management system. It affects Grav versions prior to 1.7.42 and allows for remote code execution by exploiting the default `filter()` function. The vulnerability arises from the failure to block other built-in functions exposed by Twig's Core Extension, which can be used to invoke arbitrary unsafe functions. The patch in version 1.74.2 overrides the `map()` and `reduce()` filter functions to validate the argument passed to the filter, thereby remedying the vulnerability. This vulnerability poses a high risk to organizations as it allows attackers to execute arbitrary code on affected systems, potentially leading to unauthorized access, data breaches, or system compromise.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-34448 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options