Camaleon CMS media manager missing authorization checks
Low-access users of a website tool can read private files.
Summary
The media manager in Camaleon CMS lacks authorization checks. A low-privileged logged-in user can upload files, read private media, and change other users' profile photos.
Affected when
- low-privileged logged-in user account
What to do
Update Camaleon CMS to 2.9.2 or later. Also follow the migration guide in the release notes.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen