CyberSec.Space Logo
CVEブラウザに戻る

CVE-2017-1000453

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.1530%
EPSS Percentile13.33th
Published2018年1月2日
Last Modified2024年11月21日

Vulnerability Description

CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.

Affected Platforms (CPE)

📦
Cmsmadesimple

Cms Made Simple

< 2.2
📦
Cmsmadesimple

Cms Made Simple

>= 2.2.1

References & Advisories

🔗 https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/
🔗 https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/

関連する脆弱性情報

CVE-2010-466310.0

Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.

CVE-2017-167839.8

In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.

CVE-2017-177359.8

CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.

CVE-2017-177349.8

CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.