CVE-2024-52600 (GCVE-0-2024-52600)
Vulnerability from cvelistv5
Published
2024-11-19 16:30
Modified
2024-12-03 17:18
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0.
References
security-advisories@github.comhttps://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d
security-advisories@github.comhttps://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da
security-advisories@github.comhttps://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d
security-advisories@github.comhttps://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3
Impacted products
Vendor Product Version
statamic cms Version: < 5.17.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "statamic",
            "vendor": "statamic",
            "versions": [
              {
                "lessThan": "5.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-52600",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-20T16:41:07.240898Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-03T17:18:17.282Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cms",
          "vendor": "statamic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.17.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-19T16:30:12.221Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3"
        },
        {
          "name": "https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d"
        },
        {
          "name": "https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da"
        },
        {
          "name": "https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d"
        }
      ],
      "source": {
        "advisory": "GHSA-p7f6-8mcm-fwv3",
        "discovery": "UNKNOWN"
      },
      "title": "Statamic CMS has Path Traversal in Asset Upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-52600",
    "datePublished": "2024-11-19T16:30:12.221Z",
    "dateReserved": "2024-11-14T15:05:46.770Z",
    "dateUpdated": "2024-12-03T17:18:17.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-52600\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-11-19T17:15:56.030\",\"lastModified\":\"2024-11-19T21:56:45.533\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0.\"},{\"lang\":\"es\",\"value\":\"Statmatic es un sistema de gesti\u00f3n de contenido (CMS) basado en Laravel y Git. Antes de la versi\u00f3n 5.17.0, los recursos cargados con nombres de archivo manipulados de forma adecuada pod\u00edan hacer que se colocaran en una ubicaci\u00f3n diferente a la configurada. El problema afecta a los formularios de interfaz con campos de \\\"recursos\\\" y otros lugares donde se pueden cargar recursos, aunque los usuarios necesitar\u00edan permisos de carga de todos modos. Los archivos se pueden cargar para que se ubiquen en el servidor en una ubicaci\u00f3n diferente y potencialmente anulen los archivos existentes. No es posible atravesar un contenedor de recursos fuera de \u00e9l. Esta vulnerabilidad de path traversal se ha corregido en la versi\u00f3n 5.17.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-52600\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-20T16:41:07.240898Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*\"], \"vendor\": \"statamic\", \"product\": \"statamic\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"5.17.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-03T17:18:04.997Z\"}}], \"cna\": {\"title\": \"Statamic CMS has Path Traversal in Asset Upload\", \"source\": {\"advisory\": \"GHSA-p7f6-8mcm-fwv3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"statamic\", \"product\": \"cms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.17.0\"}]}], \"references\": [{\"url\": \"https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3\", \"name\": \"https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d\", \"name\": \"https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da\", \"name\": \"https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d\", \"name\": \"https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-11-19T16:30:12.221Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-52600\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-03T17:18:17.282Z\", \"dateReserved\": \"2024-11-14T15:05:46.770Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-11-19T16:30:12.221Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.