CVE-2024-6947 Flute CMS Notification ContentParser.php replaceContent code injection
Remote attackers can execute arbitrary code via the Notification Handler's replaceContent function in Flute CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6947?
CVE-2024-6947 is a medium-severity code injection vulnerability in Flute CMS, published on 21 Jul 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been rated as critical. This issue affects the function replaceContent of the file app/Core/Support/ContentParser.php of the component Notification Handler. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272069 was assigned to this vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2024-6947?
It affects 1 product.
Products include Flute-Cms Flute.
How do I fix CVE-2024-6947?
No fix has been published for CVE-2024-6947 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-6947 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6947 exists.
Other vulnerabilities in Flute CMS
Sources
Also known as GHSA-6jqh-x2v6-q5jq.