PT-2024-33090 · Edito Cms · Edito Cms

Published 2024-07-02 · Updated 2024-07-02 · CVE-2024-4836

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Edito CMS versions 3.5 through 3.25

Description The issue allows unauthenticated users to download configuration files, leading to sensitive data leakage. The problem was resolved in releases dated from January 10th, 2014.

Recommendations For Edito CMS versions 3.5 through 3.25, update to a version released after January 10th, 2014, to resolve the issue.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2024-4836

Affected Products

Edito Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-4836 · Security Note
• https://cert.pl/en/posts/2024/07/CVE-2024-4836 · Note
• https://cert.pl/posts/2024/07/CVE-2024-4836 · Note
• https://t.me/cvenotify/84979 · Telegram Post
• https://edito.pl · Note