Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Magnolia CMS multiple access control vulnerabilities
From: Adrian Furtuna <adif2k8 () gmail com>
Date: Tue, 25 Jun 2013 18:33:39 +0300

Multiple access control vulnerabilities in Magnolia CMS, Community and
Enterprise editions


A non-admin user (such as default users eric / peter) can access and
execute multiple administrative functionalities of the CMS by accessing
directly the specific URLs.

Magnolia CMS

Magnolia International Ltd.

Affected versions:
Magnolia CMS <= 4.5.8
Tested on: 4.5.8, 4.5.7 and 4.5.3, both Community and Enterprise editions

Not-affected version:
Magnolia CMS 4.5.9

Product information:
Magnolia CMS is an open-source Web Content Management System that focuses
on providing an intuitive user experience in an enterprise-scale system.

Vulnerability details:
The following functionalities can be accessed and executed by a non-admin
user based on the URL:

- View and set the log level of Magnolia

- Read Magnolia log files (can contain sensitive information)

- View Magnolia configuration:

- View permissions of Magnolia users. Also can be used for user enumeration

- Send arbitrary email messages

- View the list of installed modules

- Execute arbitrary queries in the repository (limited by the current
user's rights)

Vendor contact log:
2013-04-25: Contacting vendor through support () magnolia-cms com
2013-04-29: Vendor acknowledges the receipt of the advisory
2013-04-29: Vendor confirms the vulnerability
2013-06-03: Vendor releases version 4.5.9 which fixes the vulnerability

This vulnerability was discovered by Adrian Furtuna

Upgrade to the latest version of Magnolia CMS
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Magnolia CMS multiple access control vulnerabilities Adrian Furtuna (Jun 25)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]