GHSA-79wq-g4v9-gfj4 BIT-publify-2022-2815 CVE-2022-2815
Publify Core does not strip metadata from images
- Severity
- 6.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.58%
- Chance of exploitation in the next 30 days. Higher than 47.64% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-922 Insecure Storage of Sensitive Information
- Fix
9.2.10- Upgrade publify_core to this version or later
Description
Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| publify_core | < 9.2.10 |
9.2.10 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
publify_core RubyGems → 9.2.10
- bundler
bundle update publify_core # Gemfile: gem "publify_core", ">= 9.2.10"
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-922: Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8fm5-gg2f-f66q Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction | Medium | Also affects publify_core |
| GHSA-g7gf-2rqw-5rwx Publify contains Weak Password Requirements | Medium | Also affects publify_core |
| GHSA-rc42-jghf-vr8f Integer overflow in publify_core | Critical | Also affects publify_core |
| GHSA-q3rm-f527-ghxj Publify Improper Input Validation vulnerability | Critical | Also affects publify_core |
| GHSA-wmh9-x28j-c6gr Cross site scripting in publify | Medium | Also affects publify_core |
| GHSA-3h7v-wqw7-ff28 Cross site scripting in publify | Medium | Also affects publify_core |
| GHSA-c273-c6vg-4pv5 Publify has Improper Access Controls | Medium | Also affects publify_core |
| GHSA-3hwx-c6cp-q972 Publify vulnerable to cross site scripting | Critical | Also affects publify_core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor