Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.

Threat-Mapped Scoring

Score: 3.0

Priority: P2 - Serious (High)

• S1 – Steal Customer Account Information

EPSS

Score: 0.00664
Percentile: 0.70267

CVSS Scoring

Mapped CWE(s)

• CWE-311 : Missing Encryption of Sensitive Data

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1040 : Network Sniffing
  Kill Chain: credential-access
• T1111 : Multi-Factor Authentication Interception
  Kill Chain: credential-access
• T1005 : Data from Local System
  Kill Chain: collection
• T1539 : Steal Web Session Cookie
  Kill Chain: credential-access
• T1005 : Data from Local System
  Kill Chain: collection
• T1552.004 : Private Keys
  Kill Chain: credential-access
• T1056.004 : Credential API Hooking
  Kill Chain: collection
• T1111 : Multi-Factor Authentication Interception
  Kill Chain: credential-access
• T1040 : Network Sniffing
  Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*

← Back to Home