medium4.3
CVE-2021-25971
Camaleon CMS vulnerable to Uncaught Exception
Impact
In Camaleon CMS, versions 2.0.1 through 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | camaleon_cms | >= 2.0.1, < 2.6.0.1 | 2.6.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tuzitio | Camaleon Cms | from 2.0.1 through 2.6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25971
- https://github.com/advisories/GHSA-r2w2-h6r8-3r53
- https://nvd.nist.gov/vuln/detail/CVE-2021-25971
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2021-25971.yml