Zenario uses Twig filters insecurely in the Twig Snippet plugin
The advisory, in context
Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 9.5.60437
Fixed in 9.5.60437
84 explicitly affected versions
7.5.40440, 7.5.41006, 7.5.41499, 7.5.41633, 7.5.42085, 7.5.42990, 7.5.47180, 7.6.41504, 7.6.41633, 7.6.42085, 7.6.42990, 7.6.47180, 7.7.42682, 7.7.42963, 7.7.42990, 7.7.44223, 7.7.47180, 7.7.47369, 7.7.48583, 8.0.44237, 8.0.44273, 8.0.44294, 8.0.44521, 8.0.45032, 8.0.45250, 8.0.45529, 8.0.47180, 8.0.48583, 8.1.45530, 8.1.45698, 8.1.46089, 8.1.46433, 8.1.46615, 8.1.47180, 8.1.47369, 8.1.48583, 8.2.46436, 8.2.46614, 8.2.47180, 8.2.47369, 8.2.47992, 8.2.48583, 8.3.47997, 8.3.48583, 8.3.50564, 8.4.50565, 8.4.51340, 8.5.50567, 8.5.50837, 8.5.51340, 8.6.51342, 8.7, 8.8, 8.8.53370, 8.8.53725, 8.8.54063, 8.9.54063, 8.9.54149, 8.9.54153, 8.9.55141, 9.0.54156, 9.0.55141, 9.0.57473, 9.1.55143, 9.1.55510, 9.1.55619, 9.1.57473, 9.2, 9.2.55826, 9.2.57169, 9.2.57473, 9.3.57186, 9.3.57474, 9.3.57595, 9.3.57709, 9.3.57754, 9.3.58670, 9.4.58686, 9.4.59197, 9.4.59574, 9.4.60437, 9.5.59574, 9.5.59647, 9.5.60240
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.5.60437"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.5.40440",
"7.5.41006",
"7.5.41499",
"7.5.41633",
"7.5.42085",
"7.5.42990",
"7.5.47180",
"7.6.41504",
"7.6.41633",
"7.6.42085",
"7.6.42990",
"7.6.47180",
"7.7.42682",
"7.7.42963",
"7.7.42990",
"7.7.44223",
"7.7.47180",
"7.7.47369",
"7.7.48583",
"8.0.44237",
"8.0.44273",
"8.0.44294",
"8.0.44521",
"8.0.45032",
"8.0.45250",
"8.0.45529",
"8.0.47180",
"8.0.48583",
"8.1.45530",
"8.1.45698",
"8.1.46089",
"8.1.46433",
"8.1.46615",
"8.1.47180",
"8.1.47369",
"8.1.48583",
"8.2.46436",
"8.2.46614",
"8.2.47180",
"8.2.47369",
"8.2.47992",
"8.2.48583",
"8.3.47997",
"8.3.48583",
"8.3.50564",
"8.4.50565",
"8.4.51340",
"8.5.50567",
"8.5.50837",
"8.5.51340",
"8.6.51342",
"8.7",
"8.8",
"8.8.53370",
"8.8.53725",
"8.8.54063",
"8.9.54063",
"8.9.54149",
"8.9.54153",
"8.9.55141",
"9.0.54156",
"9.0.55141",
"9.0.57473",
"9.1.55143",
"9.1.55510",
"9.1.55619",
"9.1.57473",
"9.2",
"9.2.55826",
"9.2.57169",
"9.2.57473",
"9.3.57186",
"9.3.57474",
"9.3.57595",
"9.3.57709",
"9.3.57754",
"9.3.58670",
"9.4.58686",
"9.4.59197",
"9.4.59574",
"9.4.60437",
"9.5.59574",
"9.5.59647",
"9.5.60240"
]
}