What is GHSA-x2w2-qgv6-8xrm?

GHSA-x2w2-qgv6-8xrm is a security advisory published by GitHub Security Advisories with Critical severity. Elefant CMS PHP Code Execution Vulnerability

Which CVE IDs does GHSA-x2w2-qgv6-8xrm cover?

GHSA-x2w2-qgv6-8xrm covers the following CVE IDs: CVE-2018-16975. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x2w2-qgv6-8xrm?

GHSA-x2w2-qgv6-8xrm has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-x2w2-qgv6-8xrm?

GHSA-x2w2-qgv6-8xrm affects 1 product, including: composer/elefant/cms:\u003c 2.0.7.

GHSA-x2w2-qgv6-8xrmCriticalCVSS 9.8

Elefant CMS PHP Code Execution Vulnerability

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

April 23, 2024

🔗 CVE IDs covered (1)

CVE-2018-16975 →

📋 Description

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with <?php content, because of insufficient input validation in apps/designer/handlers/csspreview.php.

🎯 Affected products1

composer/elefant/cms:< 2.0.7

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-16975
https://github.com/jbroadway/elefant/issues/286
https://github.com/jbroadway/elefant/commit/0795ab57c7ffa53ff4af57e229f6d9680fa54a21
https://github.com/jbroadway/elefant/releases/tag/elefant_2_0_7_stable
https://github.com/advisories/GHSA-x2w2-qgv6-8xrm