medium5.9

CVE-2024-27623

CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI).

Impact

CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs.

Affected products

Vendor	Product	Affected versions
Cmsmadesimple	Cms Made Simple	Version 2.2.19

Weakness classification

CWE-1336

References

NVD record
CVE.org record
https://github.com/capture0x/CMSMadeSimple2
https://github.com/capture0x/CMSMadeSimple2
https://www.vicarius.io/vsociety/posts/pwning-cmsms-via-user-defined-tags-for-fun-and-learning-cve-2024-27622-27623