What is GHSA-2cvg-w29m-j8xc?

GHSA-2cvg-w29m-j8xc is a security advisory published by GitHub Security Advisories with High severity. Arbitrary Code Execution in Processwire

Which CVE IDs does GHSA-2cvg-w29m-j8xc cover?

GHSA-2cvg-w29m-j8xc covers the following CVE IDs: CVE-2023-24676. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2cvg-w29m-j8xc?

GHSA-2cvg-w29m-j8xc has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-2cvg-w29m-j8xc?

GHSA-2cvg-w29m-j8xc affects 1 product, including: composer/processwire/processwire:\u003c= 3.0.210.

GHSA-2cvg-w29m-j8xcHighCVSS 7.2

Arbitrary Code Execution in Processwire

Vendor

GitHub Security Advisories

Published

January 24, 2024

Last Modified

February 8, 2024

🔗 CVE IDs covered (1)

CVE-2023-24676 →

📋 Description

An issue found in Processwire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module.

🎯 Affected products1

composer/processwire/processwire:<= 3.0.210

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-24676
https://medium.com/%40cupc4k3/reverse-shell-via-remote-file-inlusion-in-proccesswire-cms-a8fa5ace3255
https://github.com/advisories/GHSA-2cvg-w29m-j8xc