CVE-2024-4836

LFI in sites managed by Edito CMS

Description

Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected.

Remediation

Workaround:

It is possible to disable access to sensitive files by using a modified configuration template provided by the vendor.

References

Link	Tags
https://www.edito.pl/	product
https://cert.pl/en/posts/2024/07/CVE-2024-4836	third party advisory
https://cert.pl/posts/2024/07/CVE-2024-4836	third party advisory

Frequently Asked Questions

What is the severity of CVE-2024-4836?: CVE-2024-4836 has been scored as a high severity vulnerability.
How to fix CVE-2024-4836?: As a workaround for remediating CVE-2024-4836: It is possible to disable access to sensitive files by using a modified configuration template provided by the vendor.
Is CVE-2024-4836 being actively exploited in the wild?: It is possible that CVE-2024-4836 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~29% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-4836?: CVE-2024-4836 affects Edito Edito CMS.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.

Description

Remediation

Category

CWE-552 – Files or Directories Accessible to External Parties

References

Frequently Asked Questions