GHSA-m2v2-8227-59f5
Exposure of sensitive information in concrete5/core
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | concrete5/core | < 8.5.7 | 8.5.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.
References
External links from the advisory. They lead to third-party sites.