CVE-2019-12245 — Incorrect Permission Assignment in Assets

CWE-732 — Incorrect Permission Assignment3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.3%
top 51.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Silverstripe AssetsSilverstripe FrameworkSilverstripe
Timeline
PublishedSep 25
Latest updateNov 12

Description

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶Packagistsilverstripe/assets1.0.0 — 1.3.5+1
▶Packagistsilverstripe/framework3.7.0 — 3.7.4+3

🔴Vulnerability Details

2
OSV
Lack of access control on upoaded files↗2019-11-12
▶
GHSA
Lack of access control on upoaded files↗2019-11-12
▶