CVE-2023-30145 Server-Side Template Injection in Camaleon CMS

What is CVE-2023-30145?

CVE-2023-30145 is a critical code injection vulnerability in n/a, published on 26 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

Weakness: CWE-94

Which versions are affected by CVE-2023-30145?

2 open source packages ship an affected version, including camaleon_cms. It affects 1 product.

Products include Tuzitio Camaleon Cms.

How do I fix CVE-2023-30145?

Upgrade camaleon_cms to 2.7.4 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-30145 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-30145 exists.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2024-46986 Arbitrary file write leading to RCE in Camaleon CMS Critical 10.0
• CVE-2021-25970 Camaleon CMS - Insufficient Session Expiration after Password Change High 8.8
• CVE-2024-46987 Arbitrary path traversal in Camaleon CMS High 7.7
• CVE-2021-25969 Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments Medium 6.1
• CVE-2018-18260 Camaleon CMS vulnerable to Stored Cross-site Scripting Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x487-866m-p8hr.