CVE-2022-25321

概要

参考情報

• cerebrate-project/cerebrate commit 14ec995 · Patch
• cerebrate-project/cerebrate commit e13b4e7 · Patch
• zigrin.com/advisories/cerebrate-cross-site-scripting-xss-in-bookmarks · Third Party Advisory
• zigrin.com/cakephp-application-cybersecurity-research-be-careful-with-reflections-for-your-web-application-security · Exploit

cerebrate のその他の脆弱性

• CVE-2023-41908中 5.3Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
• CVE-2023-41363中 4.3In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.
• CVE-2023-28883緊急 9.8In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.
• CVE-2023-26468緊急 9.1Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.
• CVE-2022-25320中 5.3An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.