PT-2019-13012 · Pydio · Pydio Cells

Publicado 2019-06-19 · Atualizado 2021-07-21 · CVE-2019-12903

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pydio Cells versions prior to 1.5.0

Description The issue occurs when Pydio Cells is supplied with a Name field in an unexpected Unicode format. It fails to handle this and includes the database column/table name as part of the error message, exposing sensitive information.

Recommendations For versions prior to 1.5.0, update to version 1.5.0 or later to resolve the issue.

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

CVE-2019-12903

Produtos afetados

Pydio Cells

Referências · 4

• https://pydio.com/en/community/releases/pydio-cells/pydio-cells-150-performances-features-security · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-12903 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12903 · Nota de Segurança
• https://research.loginsoft.com/vulnerability/multiple-vulnerabilities-in-pydio-cells-1-4-1 · Nota