fkie_cve-2024-52600
Vulnerability from fkie_nvd
Published
2024-11-19 17:15
Modified
2024-11-19 21:56
Severity ?
Summary
Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0."
},
{
"lang": "es",
"value": "Statmatic es un sistema de gesti\u00f3n de contenido (CMS) basado en Laravel y Git. Antes de la versi\u00f3n 5.17.0, los recursos cargados con nombres de archivo manipulados de forma adecuada pod\u00edan hacer que se colocaran en una ubicaci\u00f3n diferente a la configurada. El problema afecta a los formularios de interfaz con campos de \"recursos\" y otros lugares donde se pueden cargar recursos, aunque los usuarios necesitar\u00edan permisos de carga de todos modos. Los archivos se pueden cargar para que se ubiquen en el servidor en una ubicaci\u00f3n diferente y potencialmente anulen los archivos existentes. No es posible atravesar un contenedor de recursos fuera de \u00e9l. Esta vulnerabilidad de path traversal se ha corregido en la versi\u00f3n 5.17.0."
}
],
"id": "CVE-2024-52600",
"lastModified": "2024-11-19T21:56:45.533",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2024-11-19T17:15:56.030",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…