PT-2024-40225 · Ibexa · Ibexa/Core

Published 2024-03-20 · Updated 2024-03-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: ibexa core (affected versions not specified)

Description: The issue allows unwanted file types to be stored even if they are not easily accessible due to the content not being published. This occurs when file validation is configured to reject certain files by file type, but the file can still be saved when saving the content draft. An attacker would need existing access to create content with a file field type to exploit this.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

GHSA-9J39-4686-M3C4

Affected Products

Ibexa/Core

References · 5

• https://osv.dev/vulnerability/GHSA-9j39-4686-m3c4 · Vendor Advisory
• https://github.com/ibexa/core/security/advisories/GHSA-9j39-4686-m3c4 · Note
• https://github.com/ibexa/core · Note
• https://github.com/ibexa/core/commit/7e472317f7c75f45f72f74c38406952d8bea0de1 · Note
• https://developers.ibexa.co/security-advisories/ibexa-sa-2024-002-file-validation-and-workflow-stages · Note