Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users
概要
Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions (regenerate-yaml, apply-yaml-changes) without authentication. This issue has been patched in versions 4.17.8 and 5.9.14.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com
- web github.com