PT-2021-16895 · Unknown · Camaleon Cms

Published 2021-10-20 · Updated 2023-06-26 · CVE-2021-25971

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Camaleon CMS versions 2.0.1 through 2.6.0

Description The media upload feature in Camaleon CMS crashes permanently when an attacker with low privileged access uploads a specially crafted .svg file, resulting in an Uncaught Exception. This issue can be exploited by attackers with limited access, highlighting a potential security risk.

Recommendations For Camaleon CMS versions 2.0.1 through 2.6.0, consider disabling the media upload feature temporarily to prevent exploitation until a patch is available. Restrict access to the media upload functionality to minimize the risk of crashes caused by specially crafted .svg files.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-248

CWE-755

Related Identifiers

CVE-2021-25971

GHSA-R2W2-H6R8-3R53

Affected Products

Camaleon Cms

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2021-25971.yml · Exploit
• https://github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25971 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25971 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r2w2-h6r8-3r53 · Vendor Advisory
• https://github.com/owen2345/camaleon-cms · Note
• https://t.me/cvenotify/22366 · Telegram Post
• https://t.me/cibsecurity/30897 · Telegram Post
• https://t.me/cvenotify/23989 · Telegram Post
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25971 · Note