Hackrate

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

**Name of the Vulnerable Software and Affected Versions** Craft CMS (affected versions not specified) **Description** GraphQL entry mutation resolvers `saveEntry()` and `deleteEntry()` read the `siteId` variable directly from `$arguments` without utilizing the `ArgumentManagerprepareArguments()` function. This function is responsible for enforcing site-scope filtering by using `array intersect` against the allowed sites defined in the GraphQL schema. While the query path `ElementResolverprepareElementQuery()` correctly implements this check, mutations bypass it. Consequently, an attacker with a token scoped to one site can create, modify, or delete entries in another site by providing a different `siteId` in the mutation arguments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Craft CMS (affected versions not specified) **Description** GraphQL entry mutation resolvers `saveEntry()` and `deleteEntry()` read the `siteId` directly from `$arguments` without using the `ArgumentManagerprepareArguments()` function. This function is responsible for enforcing site-scope filtering by using `array intersect` against the allowed sites in the GraphQL schema. While the query path `ElementResolverprepareElementQuery()` correctly implements this check, mutations bypass it. Consequently, an attacker with a token scoped to one site can create, modify, or delete entries in another site by providing a different `siteId` in the mutation arguments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Craft CMS (affected versions not specified) **Description** The Twig sandbox mechanism is configured to allow dangerous functionality from the Yii framework. This configuration allows authenticated users to achieve Remote Code Execution (RCE), which is the ability to execute arbitrary commands on the server remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 4.0.0-RC1 through 4.18.1 Craft CMS versions 5.0.0-RC1 through 5.10.5 **Description** An authenticated remote code execution issue exists in the control panel element-search condition handling. A JSON cleanse bypass in `condition.config` allows Yii behavior or event configuration keys to be interpreted after decoding, which enables command execution as the PHP/web user. **Recommendations** Update Craft CMS to version 4.18.2 or later. Update Craft CMS to version 5.10.6 or later.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An issue exists where any authenticated user can change their own password without providing the current password or possessing an active elevated session. Additionally, an attacker can change passwords of other users if their account has the Edit users permission but lacks the Administrate users permission, bypassing the requirement for the latter to perform such actions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.