CVE-2019-12245: SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in…

PriorityP428medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

1.37%

68.5th percentile

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
silverstripe	assets	>= 1.0.0 < 1.3.5	1.3.5
silverstripe	assets	>= 1.4.0 < 1.4.4	1.4.4
silverstripe	framework	>= 0 < 3.6.8	3.6.8
silverstripe	framework	>= 3.7.0 < 3.7.4	3.7.4
silverstripe	framework	>= 4.0.0 < 4.3.6	4.3.6
silverstripe	framework	>= 4.4.0 < 4.4.4	4.4.4
silverstripe	silverstripe	<= 4.3.3	—

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.