Description
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | 5.7.0 – < 5.10.12 | 5.10.12 |
References
- GitHub Security Advisory (GHSA-5mjc-jqcw-6vrp) vendor-advisory
- VulnCheck Advisory: Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController third-party-advisory