GHSA-hwj7-4vgc-j3v9
Amazon S3 for Craft CMS has an Information Disclosure vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | craftcms/aws-s3 | >= 2.0.2, < 2.2.5 | 2.2.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Unauthenticated users can view a list of buckets the plugin has access to.
The `BucketsController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.
Users should update to version 2.2.5 of the plugin to mitigate the issue.
References
External links from the advisory. They lead to third-party sites.