Silverstripe Assets
Monthly
Protected file access bypass in Silverstripe Assets Module allows unauthenticated remote visitors to read files that should be restricted by the CMS file permission system. When image variants are generated via template rendering - for example calling ScaleWidth() or Convert() - the DBFile::getURL() and DBFile::getSourceURL() methods incorrectly insert an access grant into the current HTTP session, nullifying the "protected" visibility setting for those files. Versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2 are affected; patches exist at 2.4.5 and 3.1.3. No public exploit has been identified at time of analysis, and EPSS is very low at 0.03%, but SSVC flags the attack as automatable.
Protected file access bypass in Silverstripe Assets Module allows unauthenticated remote visitors to read files that should be restricted by the CMS file permission system. When image variants are generated via template rendering - for example calling ScaleWidth() or Convert() - the DBFile::getURL() and DBFile::getSourceURL() methods incorrectly insert an access grant into the current HTTP session, nullifying the "protected" visibility setting for those files. Versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2 are affected; patches exist at 2.4.5 and 3.1.3. No public exploit has been identified at time of analysis, and EPSS is very low at 0.03%, but SSVC flags the attack as automatable.