Access Control Bypass

🗓️ 13 Nov 2024 14:12:36Reported by SnykType

Access control bypass in Craft CMS via double file scheme; requires admin with allowAdminChanges; upgrade to 4.12.5 or 5.4.6.

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerability of the Craft CMS content management system lies in the improper restriction on the path to the restricted catalog. This allows a hacker to execute arbitrary code or perform Server Side Template Injection (SSTI) attacks.	4 Feb 202500:00	–	bdu_fstec
Circl	CVE-2024-52291	13 Nov 202400:30	–	circl
CNNVD	CraftCMS 路径遍历漏洞	13 Nov 202400:00	–	cnnvd
CVE	CVE-2024-52291	13 Nov 202416:12	–	cve
Cvelist	CVE-2024-52291 Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution	13 Nov 202416:12	–	cvelist
EUVD	EUVD-2024-3276	3 Oct 202520:07	–	euvd
Github Security Blog	Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution	13 Nov 202414:12	–	github
NVD	CVE-2024-52291	13 Nov 202417:15	–	nvd
OSV	CVE-2024-52291 Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution	13 Nov 202416:12	–	osv
OSV	GHSA-JRH5-VHR9-QH7Q Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution	13 Nov 202414:12	–	osv