CVE-2023-43661
High
Description
Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.
SeverityHigh
CVSS8.8
Exploit probability—
Product
All-three Cachet
PublishedOct 11, 2023
First seenOct 11, 2023
Weakness typeCWE-94Code injection
How to fix
Update
- all-three cachet2.4 or later
- cachethq/cachet2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| all-three cachet | v < 2.4 | 2.4 |
| cachethq/cachetPackagist | v < 2.4 | 2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.