Description

Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR). Thumbnails uploaded by one site owner are visible by another site owner just by knowing the other site name and fuzzing for picture names. This leads to sensitive information disclosure.

Related CPE's

a

gilacms

gila_cms

2.2.0

Vulnerable

References

https://www.navidkagalwalla.com/gila-cms-vulnerabilities

ExploitThird Party Advisory

Weaknesses

[email protected]

Primary
CWE-639

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2021-10-04T14:15:07.517

3 years ago

Last modified

2022-05-03T16:04:40.443

3 years ago