Description
Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user.
The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Edito | Edito CMS | 3.5 – ≤ 3.25 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Edito CMS - Sensitive Data Leak http/cves/2024/CVE-2024-4836.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://www.edito.pl/ product
- https://cert.pl/en/posts/2024/07/CVE-2024-4836 third-party-advisory
- https://cert.pl/posts/2024/07/CVE-2024-4836 third-party-advisory