Remote code execution in Squidex
CVE-2023-46253

9.1CRITICAL

Key Information:

Vendor

Squidex

Status
Squidex
Vendor
CVE Published:
7 November 2023

What is CVE-2023-46253?

Squidex, a popular open-source headless CMS, is affected by an arbitrary file write vulnerability in its backup restore feature, allowing authenticated attackers with specific permissions to execute arbitrary commands on the server. The vulnerability arises due to improper sanitization of the assetId in the backup restore process, which can lead to unauthorized file uploads and potential remote code execution. This flaw highlights the importance of implementing proper input validation and access controls in content management systems.

Affected Version(s)

squidex < 7.9.0

References

https://github.com/Squidex/squidex/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.