PT-2024-12554

CVE-2023-36260

Published

2024-01-30

Updated

2024-08-02

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Feed Me plugin version 4.6.1 Craft CMS version 4.6.1 Craft CMS version 4.6.1.1

Description An issue was discovered that allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected.

Recommendations For Feed Me plugin version 4.6.1, update to a version that fixes the issue. For Craft CMS version 4.6.1, update to a version that fixes the issue. For Craft CMS version 4.6.1.1, update to a version that fixes the issue. As a temporary workaround, consider restricting access to the Feed-Me Name and Feed-Me URL fields until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Angrybrad

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers

CVE-2023-36260