CVE-2022-4300

A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214901 was assigned to this vulnerability.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Ha0Liu/cveAdd/blob/developer/fastcms%E6%A8%A1%E7%89%88%E6%B3%A8%E5%85%A5/fastcms%20template%20injection%20vulnerability.md	Exploit Third Party Advisory
https://vuldb.com/?id.214901	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:xjd2020:fastcms:-:*:*:*:*:*:*:*

History

07 Nov 2023, 03:57

Type	Values Removed	Values Added
References	{'url': 'https://github.com/Ha0Liu/cveAdd/blob/developer/fastcms????/fastcms%20template%20injection%20vulnerability.md', 'name': 'https://github.com/Ha0Liu/cveAdd/blob/developer/fastcms????/fastcms%20template%20injection%20vulnerability.md', 'tags': ['Broken Link'], 'refsource': 'MISC'}

Information

Published : 2022-12-06 10:15

Updated : 2024-02-28 19:51

NVD link : CVE-2022-4300

Mitre link : CVE-2022-4300

CVE.ORG link : CVE-2022-4300

JSON object : View

Products Affected

xjd2020

fastcms

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-707

Improper Neutralization

{"id": "CVE-2022-4300", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2022-12-06T10:15:10.447", "references": [{"url": "https://github.com/Ha0Liu/cveAdd/blob/developer/fastcms%E6%A8%A1%E7%89%88%E6%B3%A8%E5%85%A5/fastcms%20template%20injection%20vulnerability.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.214901", "tags": ["Third Party Advisory"], "source": "cna@vuldb.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-707"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214901 was assigned to this vulnerability."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en FastCMS. Ha sido calificada como cr\u00edtica. Este problema afecta un procesamiento desconocido del archivo /template/edit del componente Template Handler. La manipulaci\u00f3n conduce a la inyecci\u00f3n. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. A esta vulnerabilidad se le asign\u00f3 el identificador VDB-214901."}], "lastModified": "2023-11-07T03:57:28.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xjd2020:fastcms:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A67A406E-2F4F-4CAB-81F0-69EC395551D8"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}