Description (CNA)
Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member users to create new folders, up- and download files as a ZIP archive in public spaces. Private spaces are not affected. This issue has been patched in versions 0.16.11 and 0.17.2.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| humhub / cfiles | affected < 0.16.11; affected >= 0.17.0, < 0.17.2 |
CWE
CWE-284, CWE-285
References
- https://github.com/humhub/cfiles/security/advisories/GHSA-rv2x-7qwp-2hf4
- https://github.com/humhub/cfiles/commit/75698f8e8f360cea470f0e9f264015b697ab4c09
ADP enrichment
No English description supplied.
No references supplied.