SB2014072801 - Multiple vulnerabilities in PortlandLabs concrete5
Published: July 28, 2014 Updated: March 18, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2014-5107)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.php, (7) system/permissions/files.php, (8) system/permissions/tasks.php, (9) system/permissions/users.php, (10) system/seo/view.php, (11) view.php, (12) users/attributes.php, (13) scrapbook/view.php, (14) pages/attributes.php, (15) files/attributes.php, or (16) files/search.php in single_pages/dashboard/.
2) Cross-site scripting (CVE-ID: CVE-2014-5108)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in single_pagesdownload_file.php in concrete5 before 5.6.3 when processing HTTP Referer header to index.php/download_file. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.