Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1mcHBoLW1xYzgtaDZxNc4AA3-O
Unrestricted File Upload affecting automad
A vulnerability was found in automad up to 1.10.9. This affects the function upload of the file FileCollectionController.php of the component Content Type Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely and an exploit has been disclosed publicly.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mcHBoLW1xYzgtaDZxNc4AA3-O
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 4 months ago
Updated: 4 months ago
CVSS Score: 4.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Identifiers: GHSA-fpph-mqc8-h6q5, CVE-2023-7036
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-7036
- https://github.com/screetsec/VDD/tree/main/Automad%20CMS/Unrestricted%20File%20Upload
- https://vuldb.com/?ctiid.248685
- https://vuldb.com/?id.248685
- https://github.com/advisories/GHSA-fpph-mqc8-h6q5
Blast Radius: 1.0
Affected Packages
packagist:automad/automad
Dependent packages: 0Dependent repositories: 0
Downloads: 4,581 total
Affected Version Ranges: <= 1.10.9
No known fixed version
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.3.0, 1.3.1, 1.3.2, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.6.11, 1.6.12, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.8.6, 1.8.7, 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.10.5, 1.10.6, 1.10.7, 1.10.8, 1.10.9