CVSS: 8.4EPSS: %CPEs: 2EXPL: 0CVE-2024-52291 – Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
https://notcve.org/view.php?id=CVE-2024-52291
Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled. This is fixed in 5.4.6 and 4.12.5. • https://github.com/craftcms/cms/security/advisories/GHSA-jrh5-vhr9-qh7q • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.7EPSS: %CPEs: 2EXPL: 0CVE-2024-52292 – Craft Allows Attackers to Read Arbitrary System Files
https://notcve.org/view.php?id=CVE-2024-52292
Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. • https://github.com/craftcms/cms/security/advisories/GHSA-cw6g-qmjq-6w2w • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.2EPSS: %CPEs: 2EXPL: 0CVE-2024-52293 – Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI
https://notcve.org/view.php?id=CVE-2024-52293
Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3. • https://github.com/craftcms/cms/commit/123e48a696de1e2f63ab519d4730eb3b87beaa58 https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 4CVE-2024-3311 – Dreamer CMS ThemesController.java ZipUtils.unZipFiles path traversal
https://notcve.org/view.php?id=CVE-2024-3311
A vulnerability was found in Dreamer CMS up to 4.1.3.0. It has been declared as critical. Affected by this vulnerability is the function ZipUtils.unZipFiles of the file controller/admin/ThemesController.java. The manipulation leads to path traversal. The attack can be launched remotely. • https://github.com/FaLLenSKiLL1/CVE-2024-33113 https://github.com/FaLLenSKiLL1/CVE-2024-33111 https://github.com/tekua/CVE-2024-33113 https://gitee.com/iteachyou/dreamer_cms/releases/tag/Latest_Stable_Release_4.1.3.1 https://gitee.com/y1336247431/poc-public/issues/I9BA5R https://vuldb.com/?ctiid.259369 https://vuldb.com/?id.259369 https://vuldb.com/?submit.303874 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2024-3118 – Dreamer CMS Attachment permission
https://notcve.org/view.php?id=CVE-2024-3118
A vulnerability, which was classified as critical, has been found in Dreamer CMS up to 4.1.3. This issue affects some unknown processing of the component Attachment Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://github.com/sweatxi/BugHub/blob/main/dreamer_Excessive_authority.pdf https://vuldb.com/?ctiid.258779 https://vuldb.com/?id.258779 https://vuldb.com/?submit.303196 • CWE-275: Permission Issues •