SB20240918153 - Multiple vulnerabilities in Camaleon CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20240918153

SB20240918153 - Multiple vulnerabilities in Camaleon CMS

Published: September 18, 2024 Updated: November 9, 2026

Security Bulletin ID SB20240918153
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2024-46987) Exploited

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the download_private_file method. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.


2) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an administrator to delete arbitrary files or folders on the server hosting Camaleon CMS, potentially disrupting the CMS or system.

The vulnerability exists due to missing path containment checks in the MediaController deletion action when files are uploaded locally. An administrator can submit a crafted folder parameter containing parent-directory traversal sequences to delete files outside the media directory, as demonstrated by deletion of the application's README.md file.


3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a low-privileged authenticated attacker to execute stored JavaScript in another authenticated user's or administrator's browser and act with the victim's privileges.

The vulnerability exists due to Camaleon CMS accepting and serving script-bearing SVG or HTML uploads as browser-renderable content. A low-privileged authenticated attacker can upload a malicious file and induce a victim to visit it, exposing authentication tokens and enabling unauthorized changes to CMS content.


4) Path traversal (CVE-ID: CVE-2024-46986)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to write arbitrary files on the Camaleon CMS server, subject to filesystem permissions.

The vulnerability exists due to unchecked path traversal in the MediaController upload endpoint when a registered user supplies a crafted folder parameter. An authenticated attacker can upload a Ruby file into config/initializers/ outside the upload directory and execute code when the Rails application restarts.


Remediation

Install update from vendor's website.

References