Описание
SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
Ссылки
- Release NotesVendor Advisory
- Vendor Advisory
- Vendor Advisory
- Release NotesVendor Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 4.3.3 (включая)
cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*
EPSS
Процентиль: 48%
0.00255
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
CWE-732
Связанные уязвимости
EPSS
Процентиль: 48%
0.00255
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
CWE-732