Server-Side Template Injection

2023-06-1413:14:19

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

camaleon_cms

server-side template injection

vulnerability

media_controller.rb

functions

error messages

upload

actions

arbitrary code

execution

software

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.014

Percentile

86.8%

JSON

camaleon_cms is vulnerable to Server-Side Template Injection. The vulnerability exists because the error messages in actions and upload functions at media_controller.rb are not properly sanitized, which allows an attacker to inject and execute arbitrary code with the output rendered.