VulnerabilityModified
CVE-2021-25971
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception.
MEDIUM 4.3EPSS 1.01%
Does this matter?
Lower severity and a low EPSS score (1.01%). Track it; it rarely justifies an emergency change on its own.
Description
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 1.01% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-248, CWE-755
- Affected
- tuzitio/camaleon cms
- Source
- vulnerabilitylab@mend.io
References
- https://github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2Patch, Third Party Advisory
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25971Third Party Advisory
- https://github.com/owen2345/camaleon-cms/commit/ab89584ab32b98a0af3d711e3f508a1d048147d2Patch, Third Party Advisory
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25971Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.