Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ruby_advisory_db / gems/camaleon_cms/CVE-2023-30145
Advisory ID ruby_advisory_db/gems/camaleon_cms/CVE-2023-30145
Aliases CVE-2023-30145
GHSA-x487-866m-p8hr
Summary Server-Side Template Injection in Camaleon CMS Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the `formats` parameter.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3 9.8
Reference id Reference type URL
http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html
Data source Exploit-DB
Date added May 26, 2023
Description Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI)
Ransomware campaign use Known
Source publication date May 26, 2023
Exploit type webapps
Platform ruby
Source update date June 15, 2023

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-01-16T16:18:04Z/

Decision: Track*

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2023/30xxx/CVE-2023-30145.json

Source Advisory: vulnrichment/CVE-2023-30145

View SSVC decision tree 
[{'Exploitation': 'poc'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]