CVE-2023-43661

HighCVSS 8.8/10Last modified Oct 20, 2026

Description

Cachet is an open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Oct 11, 2023
Last modified: Oct 20, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-436628.6ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible w CVE-2023-436634.3PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, ev CVE-2023-436644.3PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without a CVE-2023-436657.5In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used CVE-2023-436666.5Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, CVE-2023-436677.5Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue CVE-2023-436689.8Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, CVE-2023-436697.5The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excess CVE-2023-43676.5Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to instal CVE-2023-43688.8Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to instal CVE-2023-436836.5An issue was discovered in Malwarebytes 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). A Stack buffer out-of-bounds acce CVE-2023-436866.2An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). A large number of Firefox preference files can cause