CVE-2018-7251: Anchor CMS Logs Credentials
Summary
CVE-2018-7251: Anchor CMS Logs Credentials. Affects anchorcms/anchor-cms versions < 0.12.7. Fixed in 0.12.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Anchor CMS is an open-source content management system designed for simplicity and ease of use. It allows users to create and manage websites with minimal technical knowledge. The vulnerability in question affects Anchor CMS version 0.12.3. This version exposes the error log at an errors.log URI, which may contain MySQL credentials if a MySQL error, such as "Too many connections," has occurred.
Vulnerability Detail
The vulnerability arises from the exposure of the error log file, which contains sensitive information like MySQL credentials. If an attacker gains access to this log file, they can extract the credentials and potentially gain unauthorized access to the MySQL database. This could lead to data breaches, unauthorized modifications, or even complete control over the affected system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
0.12.7
This is the first release that contains the fix.
composer require anchorcms/anchor-cms:0.12.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually remove or restrict access to the errors.log file. By doing so, the exposure of MySQL credentials can be mitigated. However, this is not a permanent solution and should only be considered until the system can be upgraded to a fixed version.
Conclusion
In conclusion, the vulnerability in Anchor CMS version 0.12.3 exposes MySQL credentials through the error log file. To mitigate this issue, users should upgrade to version 0.12.7 or later. Alternatively, they can apply a temporary workaround by removing or restricting access to the errors.log file. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for anchorcms/anchor-cms →
FAQ
Anchor CMS is an open-source content management system that allows users to create and manage websites with ease.
The vulnerability exposes MySQL credentials, which can lead to unauthorized access, data breaches, and potential control over the affected system.
To fix this vulnerability, it is recommended to upgrade to version 0.12.7 or later of Anchor CMS.
Yes, users can manually remove or restrict access to the errors.log file as a temporary workaround.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
Related vulnerabilities
Recent vulnerabilities recorded for anchorcms/anchor-cms.
