GHSA-x2j7-6hxm-87p3
Craft CMS Remote Code Injection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | craftcms/cms | < 3.6.7 | 3.6.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
References
External links from the advisory. They lead to third-party sites.