medium5.3Public exploit code
CVE-2019-14280
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potential…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Craft CMS 2.7.9/3.2.5 - Information Disclosure2019-09-02 · webapps · php
Impact
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftcms | Craft Cms | from 2.0.2524 before 2.7.10 from 3.0.0 before 3.2.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.html
- https://github.com/craftcms/cms/blob/develop-v2/CHANGELOG-v2.md#2710---2019-07-24
- https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23
- http://packetstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.html
- https://github.com/craftcms/cms/blob/develop-v2/CHANGELOG-v2.md#2710---2019-07-24
- https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23