Vulnerability · Published Jul 2, 2024 · Assigned by CERT-PL

CVE-2024-4836LFI in sites managed by Edito CMS

High 7.5

In plain English

A high-severity security flaw in Edito CMS from Edito. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.6%top 14.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected.

Affected products (as reported)

Vendor	Product	Versions
Edito	Edito CMS	3.5 – through 3.25

Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://www.edito.pl/ product
https://cert.pl/en/posts/2024/07/CVE-2024-4836 third-party-advisory
https://cert.pl/posts/2024/07/CVE-2024-4836 third-party-advisory