CVE-2019-14280
published 2019-07-26CVE-2019-14280: In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so…
PriorityP344medium5.3CVSS 3.0
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
7.97%
94.0th percentile
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| craftcms | craft_cms | >= 2.0.2524 < 2.7.10 | 2.7.10 |
| craftcms | craft_cms | >= 3.0.0 < 3.2.6 | 3.2.6 |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.htmlhttps://github.com/craftcms/cms/blob/develop-v2/CHANGELOG-v2.md#2710---2019-07-24https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23http://packetstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.htmlhttps://github.com/craftcms/cms/blob/develop-v2/CHANGELOG-v2.md#2710---2019-07-24https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23
2019-07-26
Published