Medium – 6.1
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

PT-2024-42: Insufficient authorization in MediaCMS

Error type:

Vulnerability vector:

  • Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
  • Severity (CVSSv3.1): 6.8 (medium)
  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
  • Severity (CVSSv4.0): 6.1 (medium)

Description:

The vulnerability was identified in MediaCMS, versions < 4.1.0. The discovered vulnerability can be exploited by an authorized attacker to delete any directory in the file system knowing its absolute path, as well as substitute the contents of any user file.

Vulnerability status: Confirmed by vendor

Date of vulnerability remediation: 19.10.2024

Recommendations:

Additional information:

Researcher: Vladimir Razov (Positive Technologies)

Identifiers:

BDU:2024-10114

Vendor:

MediaCMS

Vulnerable product:

MediaCMS

Vulnerable versions:

< 4.1.0