CVE-2024-34461
Critical
Description
Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.
SeverityCritical
CVSS9.8
Exploit probability—
ProductTribalsystems/zenario
PublishedMay 4, 2024
First seenMay 4, 2024
Weakness typeCWE-94Code injection
How to fix
Update
- tribalsystems/zenario9.5.60437 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tribalsystems/zenarioPackagist | v < 9.5.60437 | 9.5.60437 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.