CVE-2021-45364
📋 TL;DR
This CVE describes a code execution vulnerability in Statamic CMS versions through 3.2.26 via SettingsController.php. However, the vendor indicates this CVE was published in error and the affected code was never used in any Statamic product. Organizations using Statamic should verify their version but note the vendor's position.
💻 Affected Systems
- Statamic CMS
📦 What is this software?
Statamic by Statamic
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution allowing complete system compromise if the vulnerability existed and was exploited
Likely Case
No impact according to vendor statement that affected code was never used in production
If Mitigated
No impact if vendor statement is accurate
🎯 Exploit Status
Limited information available due to vendor dispute of CVE validity
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch required per vendor statement. Consider updating to latest Statamic version for general security improvements.
🔧 Temporary Workarounds
Verify Statamic installation
linuxCheck if your Statamic installation contains the affected SettingsController.php code
grep -r "SettingsController" /path/to/statamic/installation
🧯 If You Can't Patch
- Monitor vendor communications for any updates regarding this CVE
- Implement general web application security controls (WAF, input validation, least privilege)
🔍 How to Verify
Check if Vulnerable:
Check Statamic version and verify if SettingsController.php contains vulnerable codeCheck Version:
Check Statamic configuration files or composer.json for version informationVerify Fix Applied:
Confirm Statamic version is 3.2.27+ or verify with vendor that installation is unaffected📡 Detection & Monitoring
Log Indicators:
- Unusual requests to SettingsController endpoints
- Unexpected file modifications
Network Indicators:
- Suspicious requests to admin/settings paths
SIEM Query:
web_access_logs WHERE uri CONTAINS 'settings' AND status_code = 200