Packagist/wintercms/winter CVE-2024-29686: high 8.8, EPSS 1.82%
Winter CMS Server-Side Template Injection (SSTI) vulnerability
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.2.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-8r5j-gm3j-cx9c
- https://nvd.nist.gov/vuln/detail/CVE-2024-29686
- https://forum.ksec.co.uk/t/webapps-winter-cms-1-2-3-server-side-template-injection-ssti-authenticated/2779
- https://github.com/wintercms/winter
- https://wintercms.com/docs/v1.2/docs/cms/themes#template-structure
- https://www.exploit-db.com/exploits/51893
CVE-2024-29686 · published · modified · JSON