Design/Logic Flaw

In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering...

CVE-2023-29770

In CVE-2023-29770, Sentrifugo 3.5 is affected by a vulnerability in AssetsController::uploadsaveAction that allows an authenticated attacker to upload arbitrary files without extension filtering. The issue enables unauthenticated? No—authenticated attacker per description, with impact described a...