CVE-2023-24676

2024-01-2421:15:08

Google

osv.dev

processwire

code execution

download parameter

security vulnerability

module installation

0.001 Low

EPSS

Percentile

22.9%

JSON

An issue found in Processwire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module.

CPENameOperatorVersion
processwireeq3.0.123
processwireeq3.0.148
processwireeq3.0.164
processwireeq3.0.165
processwireeq3.0.184
processwireeq3.0.200
processwireeq3.0.210
processwireeq3.0.34
processwireeq3.0.35
processwireeq3.0.36

Name	Operator	Version
processwire	eq	3.0.123
processwire	eq	3.0.148
processwire	eq	3.0.164
processwire	eq	3.0.165
processwire	eq	3.0.184
processwire	eq	3.0.200
processwire	eq	3.0.210
processwire	eq	3.0.34
processwire	eq	3.0.35
processwire	eq	3.0.36