High severityNVD Advisory· Published Mar 29, 2024· Updated Aug 23, 2024

CVE-2024-29686

Description

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be entered by a trusted user, such as the owner of the server that hosts Winter CMS, or a developer working for them.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
wintercms/winterPackagist	<= 1.2.3	—

Affected products

Winter/CMSdescription
ghsa-coords
pkg:composer/wintercms/winter
Range: <= 1.2.3

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-8r5j-gm3j-cx9cghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-29686ghsaADVISORY
forum.ksec.co.uk/t/webapps-winter-cms-1-2-3-server-side-template-injection-ssti-authenticated/2779ghsaWEB
wintercms.com/docs/v1.2/docs/cms/themesghsaWEB
www.exploit-db.com/exploits/51893ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000