Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request: cmsmadesimple before 1.11.8 / bad upstream behaviour vs. CVE assignment
From: cve-assign () mitre org
Date: Mon, 30 Dec 2013 10:06:08 -0500 (EST)

Hash: SHA1

Can we get this assigned?

Diff between 1.11.7 and 1.11.8: http://paste.nerv.fi/61005941.txt

The paste includes:

+Version 1.11.8 - Fioreana
+Core - Bug Reports
+  - #8807 Section headers are accessible through changing URL

Does anyone here have a dev.cmsmadesimple.org account (possibly
available through http://dev.cmsmadesimple.org/signup registration)
and want to comment on the contents of 8807?

(A CVE assignment based solely on "a minor security issue" is not
impossible, but checking the listed bug numbers first is often

MITRE, in general, can't take responsibility for doing original
research on every diff of every product to determine what changes are
vulnerability fixes. Possibly we, or others, could suggest a guess in
case someone more familiar with the product can quickly confirm or
reject that. So, here is a guess offered with VERY LOW confidence:

The paste also includes:

 function expandall()
      $userid = get_userid();
-     $contentops = cmsms()->GetContentOperations();
-     $all = $contentops->GetAllContent(false);
-     $cs = '';
-     foreach ($all as $thisitem)
+     $hiermanager = cmsms()->GetHierarchyManager();

suggesting that expandall is now done in a different way. The source
code says:

$lang['admin']['expandall'] = 'Expand All Sections';

so maybe it's possible that incorrect expandall behavior has some
relationship to the visibility of private "Section headers" referenced
in 8807. In other words, if expandall is done unsafely, maybe the
information produced later by the display_content_list function can
contain unintended section headers if there's a URL manipulation
(adding "&expandall=1" or whatever). If any of this is relevant (and,
quite possibly, it's not), this would seem consistent with the
vendor's "minor security issue" wording.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
Version: GnuPG v1.4.14 (SunOS)


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]