{"id":6391,"date":"2025-02-21T10:02:58","date_gmt":"2025-02-21T10:02:58","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/cisa-warns-of-craft-cms-flaw\/"},"modified":"2025-02-21T10:02:59","modified_gmt":"2025-02-21T10:02:59","slug":"cisa-warns-of-craft-cms-flaw","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/cisa-warns-of-craft-cms-flaw\/","title":{"rendered":"CISA Warns of Craft CMS Flaw"},"content":{"rendered":"\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">February 21, 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">Web Security \/ Vulnerability<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\">\n<a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgRBgFxS0Ia4xmogY2EQOWx8dtz_1LFihO9ceVtHWJ_hMNoSmen7yNj8CMPc7vDsILuOCn9Im8DPjd4BU4kbOTXuGz0L1pI-1ewFUFeZyknVZc_4ParojIDS_wkhG2BY8WvzduJPOR-JVMLf4MfkbGnekfaZsahxr0vq5m9rl1nJL3j4EW8hvbzuCYDVlN-\/s728-rw-e365\/craftcms.png\" style=\"clear: left; display: block; float: left;  text-align: center;\" rel=\"nofollow noopener\" target=\"_blank\"><\/p>\n<p><\/a>\n<\/div>\n<p>A significant security flaw in the Craft content management system (CMS) has been <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/02\/20\/cisa-adds-two-known-exploited-vulnerabilities-catalog\" rel=\"noopener nofollow\" target=\"_blank\">added<\/a> to the U.S. Cybersecurity and Infrastructure Security Agency&#8217;s (CISA) Known Exploited Vulnerabilities (<a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" rel=\"noopener nofollow\" target=\"_blank\">KEV<\/a>) catalog due to evidence of active exploitation.<\/p>\n<p>The vulnerability, identified as <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-23209\" rel=\"noopener nofollow\" target=\"_blank\">CVE-2025-23209<\/a> (with a CVSS score of 8.1), affects Craft CMS versions 4 and 5. It was addressed by the project maintainers in late December 2024 with the release of versions 4.13.8 and 5.5.8.<\/p>\n<p>According to the agency, &#8220;Craft CMS contains a code injection vulnerability that allows for remote code execution as vulnerable versions have compromised user security keys.&#8221;<\/p>\n<div class=\"dog_two clear\">\n<center class=\"cf\"><br \/>\n<a href=\"https:\/\/thehackernews.uk\/saas-security-v2-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><br \/>\n<img fetchpriority=\"high\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhT2OnXk97z-adL5WBKzz6wsA7vAhygg3Px0VPmqpH5hH4AErnYajTCpDN7SLy43ejD_T4Skv8OMOdG9qpzMfihrj8o7qSznLKA8zg7jW8L4hY8-umwTNZSpAj0JvtG3VGMFGw9n7hMyea1NpVSXp6yTaClLUQ3GujxwlEuLmQFSsVH28WQy6vp-cOGG0p_\/s728-rw-e100\/saas-security-v2-d.png\" width=\"727\" height=\"90\"\/><br \/>\n<\/a><br \/>\n<\/center>\n<\/div>\n<p>The vulnerability affects the following software versions:<\/p>\n<ul>\n<li>>= 5.0.0-RC1, < 5.5.5<\/li>\n<li>>= 4.0.0-RC1, < 4.13.8<\/li>\n<\/ul>\n<p>According to a <a href=\"https:\/\/github.com\/craftcms\/cms\/security\/advisories\/GHSA-x684-96hh-833x\" rel=\"noopener nofollow\" target=\"_blank\">GitHub advisory<\/a> released by Craft CMS, all unpatched versions of Craft with a compromised security key are impacted by the security defect.<\/p>\n<p>Craft CMS noted that &#8220;if you can&#8217;t update to a patched version, then rotating your security key and ensuring its privacy will help to mitigate the issue.&#8221;<\/p>\n<p>At present, the circumstances surrounding the compromise of user security keys are unclear. To mitigate the risk posed by the vulnerability, Federal Civilian Executive Branch (FCEB) agencies are advised to apply the necessary fixes by March 13, 2025.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">If you found this article interesting, follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener nofollow\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener nofollow\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content.<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/02\/cisa-flags-craft-cms-vulnerability-cve.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue802February 21, 2025\ue804Ravie LakshmananWeb Security \/ Vulnerability A significant security flaw in the Craft content management system (CMS) has been added to the U.S. Cybersecurity and Infrastructure Security Agency&#8217;s (CISA)&#8230;<\/p>\n","protected":false},"author":19,"featured_media":6392,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-6391","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/02\/craftcms.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/6391","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=6391"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/6391\/revisions"}],"predecessor-version":[{"id":6393,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/6391\/revisions\/6393"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/6392"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=6391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=6391"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=6391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}