CVE-2018-20465: High severity craft cms vulnerability
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.
Other sources
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-20465?
CVE-2018-20465 is a vulnerability in Craft CMS through version 3.0.34 that allows remote authenticated administrators to read sensitive information via server-side template injection.
How does CVE-2018-20465 work?
CVE-2018-20465 works by exploiting a server-side template injection vulnerability in Craft CMS, which allows remote authenticated administrators to read sensitive information.
What is the severity of CVE-2018-20465?
CVE-2018-20465 has a severity rating of 7.2 (High).
How can I fix CVE-2018-20465?
To fix CVE-2018-20465, upgrade Craft CMS to a version beyond 3.0.34.
Are there any references for CVE-2018-20465?
Yes, you can find references for CVE-2018-20465 at the following links: [Link 1](https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md) and [Link 2](https://github.com/phuctam/Server-Side-Template-Injection-in-CraftCMS-/issues/1).