要点
- CVE-2024-52600 は statamic/cms に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.58%（全脆弱性の 47.5% より高い）。
- 対処：5.17.0 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| statamic/cms Packagist | < 5.17.0
| 5.17.0
|
概要
Assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured.
Impact
- Affects front-end forms with
assets fields.
- Affects other places where assets can be uploaded, although users would need upload permissions anyway.
- Files can be uploaded so they would be located on the server in a different location, and potentially override existing files.
- Traversal outside an asset container was not possible.
Patches
This has been fixed in 5.17.0.
NVD の説明
Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン