Lack of access control on upoaded files · CVE-2019-12245 · GitHub Advisory Database · GitHub

Lack of access control on upoaded files

Moderate severity GitHub Reviewed Published Nov 12, 2019 to the GitHub Advisory Database • Updated Feb 5, 2024

Package

silverstripe/assets (Composer)

Affected versions

>= 1.0.0, < 1.3.5

>= 1.4.0, < 1.4.4

Patched versions

1.3.5

1.4.4

silverstripe/framework (Composer)

< 3.6.8

>= 3.7.0, < 3.7.4

>= 4.0.0, < 4.3.6

>= 4.4.0, < 4.4.4

3.6.8

3.7.4

4.3.6

4.4.4

Description

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.

References

Reviewed Nov 12, 2019

Published to the GitHub Advisory Database Nov 12, 2019

Last updated Feb 5, 2024

Severity

Moderate

5.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N