GHSA-QPGW-2C72-4C89中危已审查

Mautic users able to download any files from server using filemanager

OSV 1.4.0 · github-reviewed · 修改于 2023-09-11 21:40

发布时间

2021-01-20 04:50

GitHub 审查时间

2021-01-20 04:50

NVD 发布时间

2018-01-04 01:29

源文件

advisories/github-reviewed/2021/01/GHSA-qpgw-2c72-4c89/GHSA-qpgw-2c72-4c89.json

公告说明

Impact

Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

Patches

Update to 2.12.0 or later.

Workarounds

None

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

受影响的软件包

Packagist

mautic/core

ECOSYSTEM

1.0.0

标识信息

别名 / CVE

CVE-2017-1000490

CWE

CWE-22

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-qpgw-2c72-4c89",
  "aliases": [
    "CVE-2017-1000490"
  ],
  "details": "### Impact\nMautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.\n\n### Patches\nUpdate to 2.12.0 or later.\n\n### Workarounds\nNone\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [[email protected]](mailto:[email protected])",
  "summary": "Mautic users able to download any files from server using filemanager",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.12.0"
            }
          ]
        }
      ],
      "package": {
        "name": "mautic/core",
        "ecosystem": "Packagist"
      }
    }
  ],
  "modified": "2023-09-11T13:40:01Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2021-01-19T20:50:38Z",
  "references": [
    {
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-qpgw-2c72-4c89",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000490",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/mautic/mautic/commit/3b01786433ae15e9a23f1eb9b0d3dfdb065b6241",
      "type": "WEB"
    },
    {
      "url": "https://github.com/mautic/mautic/releases/tag/2.12.0",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2018-01-03T17:29:00Z",
    "github_reviewed_at": "2021-01-19T20:50:28Z"
  }
}