GHSA-r2w2-h6r8-3r53

Camaleon CMS vulnerable to Uncaught Exception

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-25971

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	camaleon_cms	>= 2.0.1, < 2.6.0.1	2.6.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

In Camaleon CMS, versions 2.0.1 through 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-25971 advisory
https://github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2 web
https://github.com/owen2345/camaleon-cms package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2021-25971.yml web
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25971 web