GHSA-8CFW-PCWH-V63W Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

Impact Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to escape the Twig sandbox "safe mode" that is meant to restrict what template code can do. Using any of the following permissions, an attacker can read and modify arbitrary database...

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

Impact Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to escape the Twig sandbox "safe mode" that is meant to restrict what template code can do. Using any of the following permissions, an attacker can read and modify arbitrary database...

CVE-2024-54149

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such...

CVE-2024-54149

creationtimestamp| type| source ---|---|--- 2024-12-09 20:59:45+00:00| seen| https://infosec.exchange/users/cve/statuses/113624874021159386 2024-12-09 23:04:28+00:00| seen| https://t.me/cvedetector/12448...

CVE-2024-54149 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such...