PT-2021-21869 · Gila Cms · Gila Cms

Published 2021-10-04 · Updated 2022-05-03 · CVE-2021-37777

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Gila CMS version 2.2.0

Description: The issue allows thumbnails uploaded by one site owner to be visible to another site owner, potentially leading to sensitive information disclosure. This can be achieved by knowing the other site name and fuzzing for picture names.

Recommendations: For Gila CMS version 2.2.0, consider restricting access to thumbnail uploads to prevent unauthorized viewing by other site owners. As a temporary workaround, restrict access to the thumbnail directory until a patch is available.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2021-37777

Affected Products

Gila Cms

References · 4

• 🔥 https://navidkagalwalla.com/gila-cms-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-37777 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37777 · Vendor Advisory
• https://t.me/cibsecurity/29871 · Telegram Post