GHSA-r2w2-h6r8-3r53 CVE-2021-25971
Camaleon CMS vulnerable to Uncaught Exception
- Severity
- 4.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.01%
- Chance of exploitation in the next 30 days. Higher than 63.08% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-248 Uncaught Exception
- Fix
2.6.0.1- Upgrade camaleon_cms to this version or later
Description
In Camaleon CMS, versions 2.0.1 through 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| camaleon_cms | >= 2.0.1, < 2.6.0.1 |
2.6.0.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
camaleon_cms RubyGems → 2.6.0.1
- bundler
bundle update camaleon_cms # Gemfile: gem "camaleon_cms", ">= 2.6.0.1"
Severity breakdown
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-jw5g-f64p-6x78 Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation | Medium | Also affects camaleon_cms |
| GHSA-rp28-mvq3-wf8j Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment | Critical | Also affects camaleon_cms |
| GHSA-hhxg-rvc9-8726 camaleon_cms affected by cross site scripting | Medium | Also affects camaleon_cms |
| GHSA-75j2-9gmc-m855 Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) | Medium | Also affects camaleon_cms |
| GHSA-8fx8-3rg2-79xw Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) | Medium | Also affects camaleon_cms |
| GHSA-7x4w-cj9r-h4v9 Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185) | High | Also affects camaleon_cms |
| GHSA-r9cr-qmfw-pmrc Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184) | Medium | Also affects camaleon_cms |
| GHSA-cp65-5m9r-vc2c Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183) | High | Also affects camaleon_cms |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor