CRITICAL9.8

GHSA-hr2r-w6wc-25pv

Zenario uses Twig filters insecurely in the Twig Snippet plugin

Quick fix

GHSA-hr2r-w6wc-25pv — tribalsystems/zenario: upgrade to the fixed version with the command below.

composer require tribalsystems/zenario:^9.5.60437

Details

Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/tribalsystems/zenario

Introduced in: 0Fixed in: 9.5.60437

Fixcomposer require tribalsystems/zenario:^9.5.60437

References

https://nvd.nist.gov/vuln/detail/CVE-2024-34461[ADVISORY]
https://github.com/TribalSystems/Zenario/commit/72afb59da34bace812bffb195d01168a357ff664[WEB]
https://github.com/TribalSystems/Zenario[PACKAGE]
https://zenar.io/zenario-9/blog/zenario-9560437-patch-released[WEB]