high8.8
CVE-2023-22953
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
Impact
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Expressionengine | Expressionengine | before 7.2.6 |
References
- NVD record
- CVE.org record
- https://docs.expressionengine.com/latest/installation/changelog.html
- https://gist.github.com/ahmedsherif/7b8f18a54a80ae0ac5ff6307c35b7d43
- https://hackerone.com/reports/1820492
- https://docs.expressionengine.com/latest/installation/changelog.html
- https://gist.github.com/ahmedsherif/7b8f18a54a80ae0ac5ff6307c35b7d43
- https://hackerone.com/reports/1820492