RSS   Vulnerabilities for 'Statamic'   RSS

2022-03-25
 
CVE-2022-24784

CWE-326
 

 
Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such requests can eventually uncover the entire hash. The hash is not present in the response, however the presence or absence of a result confirms if the character is in the right position. The API has throttling enabled by default, making this a time intensive task. Both the REST API and the users endpoint need to be enabled, as they are disabled by default. The issue has been fixed in versions 3.2.39 and above, and 3.3.2 and above.

 
2022-02-10
 
CVE-2021-45364

NVD-CWE-noinfo
 

 
** DISPUTED ** A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there was an error in publishing this CVE Record, and that all parties agree that the affected code was not used in any Statamic product.

 
2018-12-19
 
CVE-2018-19598

CWE-79
 

 
Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request.

 

 >>> Vendor: Statamic 2 Products
Framework cms
Statamic


Copyright 2024, cxsecurity.com

 

Back to Top