critical9.8
CVE-2021-27903
An issue was discovered in Craft CMS before 3.6.7.
Impact
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftcms | Craft Cms | before 3.6.7 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security
- https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security
- https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38