Path Traversal Vulnerability in Croogo CMS 4.0.7
Summary
GHSA-g5p6-3j82-xfm4: Croogo CMS has a path traversal vulnerability. Affects croogo/croogo versions < 4.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Croogo CMS is an open-source content management system built on the CakePHP framework. It provides a flexible platform for managing content and offers features such as user management, customizable themes, and plugin support. However, version 4.0.7 has been identified to have a critical path traversal vulnerability that allows unauthorized access to sensitive files on the server.
Vulnerability Detail
The path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to manipulate the 'edit-file' parameter to access arbitrary files on the server. This vulnerability arises from improper validation of user input, which can lead to unauthorized file access, potentially exposing sensitive information. Attackers can exploit this flaw to read configuration files, user data, or other sensitive information, posing a significant risk to the integrity and confidentiality of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected functionality by modifying the server configuration to deny access to the 'edit-file' parameter until the package is updated. This can be done by adding rules in your web server configuration (e.g., .htaccess for Apache) to block requests containing this parameter.
Conclusion
The path traversal vulnerability in Croogo CMS 4.0.7 poses a significant risk to applications using this version. It is crucial to update to the latest version to protect against potential exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for vulnerabilities in your open-source dependencies.
See every vulnerability recorded for croogo/croogo →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory structure, potentially exposing sensitive information.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, which may include configuration files, user data, or other critical information, jeopardizing the security of the application.
Yes, a patched version of Croogo CMS is available. Updating to the latest version will resolve the vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for croogo/croogo.
