CVE-2019-12245

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile. An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension...

CVE-2019-12245

Summary: SilverStripe up to 4.3.3 is affected by an access-control weakness in protected files uploaded via Upload::loadIntoFile(). An attacker may guess a filename in silverstripe/assets using the AssetControlExtension, potentially exposing protected assets. Remediation details are not specified...