PT-2023-9690 · Mediacms · Mediacms

Published 2023-10-17 · Updated 2023-10-17

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:N/AC:H/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions MediaCMS (affected versions not specified)

Description The issue is related to improper authorization in the MediaCMS content management system. It allows a remote attacker to delete directories in the file system and replace user file contents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2024-10114

Affected Products

Mediacms

References · 4

• https://bdu.fstec.ru/vul/2024-10114 · Security Note
• https://github.com/mediacms-io/mediacms/releases/tag/v4.1.0 · Note
• https://github.com/mediacms-io/mediacms/security/advisories/GHSA-x3p4-4442-q2c3 · Note
• https://medium.com/@MediaCMS.io/fixing-remote-code-execution-vulnerabilities-in-mediacms-b46ace5fbb7d · Note