Description
Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Admidio | admidio | < 5.0.16 | 5.0.16 |
References
- GitHub Security Advisory (GHSA-552r-jc93-7qr3) vendor-advisory
- VulnCheck Advisory: Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed third-party-advisory