Vulnerability · Published Oct 20, 2021 · Assigned by Mend
CVE-2021-25971Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature
Medium 4.3
In plain English
A medium-severity security flaw in camaleon_cms from camaleon_cms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)1.0%top 36.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | camaleon_cms | 2.6.0.1 | GHSA-r2w2-h6r8-3r53 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| camaleon_cms | camaleon_cms | 2.0.1 – before unspecifiedunspecified – through 2.6.0 |
Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L