CVE-2023-46818: Code Injection
Published Oct 27, 2023
·Updated
An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if adminallowlangedit is enabled.
Affected Software
2 affected components
ISPConfig ISPConfig<3.2.11
ISPConfig ISPConfig=3.2.11
Remediation
Patch Available
Event History
Oct 27, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-46818?
CVE-2023-46818 has a high severity rating due to the potential for PHP code injection.
2
How do I fix CVE-2023-46818?
To fix CVE-2023-46818, update ISPConfig to version 3.2.11p1 or later.
3
Who is affected by CVE-2023-46818?
CVE-2023-46818 affects ISPConfig versions prior to 3.2.11p1 with admin_allow_langedit enabled.
4
What can be exploited in CVE-2023-46818?
CVE-2023-46818 can be exploited to perform PHP code injection through the language file editor.
5
What should administrators do regarding CVE-2023-46818?
Administrators should disable admin_allow_langedit if they cannot upgrade to the patched version.