CVE-2019-16409
published 2019-09-26CVE-2019-16409: In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.20%
64.4th percentile
In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the upgrade process automates the destruction of these insecure artefacts, nor alerts the user to the criticality of destruction.)
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| silverstripe | framework | >= 4.0.0 < 4.3.5 | 4.3.5 |
| silverstripe | framework | >= 4.4.0 < 4.4.4 | 4.4.4 |
| silverstripe | silverstripe | 3.0.0 – 3.7.4 | — |
| symbiote | silverstripe-versionedfiles | 0 – 2.0.3 | — |
| symbiote | versionedfiles | <= 2.0.3 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SilverStripe Versioned Files module Unpublished files are exposed publicly
osv·2019-11-12
CVE-2019-16409 [MEDIUM] SilverStripe Versioned Files module Unpublished files are exposed publicly
SilverStripe Versioned Files module Unpublished files are exposed publicly
In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the upgrade process automates the destruction of these insecure artefacts, nor alerts the user to the criticality of destruction.)
GHSA
SilverStripe Versioned Files module Unpublished files are exposed publicly
ghsa·2019-11-12
CVE-2019-16409 [MEDIUM] CWE-200 SilverStripe Versioned Files module Unpublished files are exposed publicly
SilverStripe Versioned Files module Unpublished files are exposed publicly
In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the upgrade process automates the destruction of these insecure artefacts, nor alerts the user to the criticality of destruction.)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/silverstripe/silverstripe-frameworkhttps://github.com/symbiote/silverstripe-versionedfileshttps://www.silverstripe.org/download/security-releases/cve-2019-16409https://github.com/silverstripe/silverstripe-frameworkhttps://github.com/symbiote/silverstripe-versionedfileshttps://www.silverstripe.org/download/security-releases/cve-2019-16409
2019-09-26
Published