Re: CVE request: cmsmadesimple before 1.11.8 / bad upstream behaviour vs. CVE assignment

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Can we get this assigned?

> Diff between 1.11.7 and 1.11.8: http://paste.nerv.fi/61005941.txt

The paste includes:

> +Version 1.11.8 - Fioreana
> +Core - Bug Reports
> +  - #8807 Section headers are accessible through changing URL

Does anyone here have a dev.cmsmadesimple.org account (possibly
available through http://dev.cmsmadesimple.org/signup registration)
and want to comment on the contents of 8807?

(A CVE assignment based solely on "a minor security issue" is not
impossible, but checking the listed bug numbers first is often
useful.)

MITRE, in general, can't take responsibility for doing original
research on every diff of every product to determine what changes are
vulnerability fixes. Possibly we, or others, could suggest a guess in
case someone more familiar with the product can quickly confirm or
reject that. So, here is a guess offered with VERY LOW confidence:

The paste also includes:

>  function expandall()
>  {
>       $userid = get_userid();
> -     $contentops = cmsms()->GetContentOperations();
> -     $all = $contentops->GetAllContent(false);
> -     $cs = '';
> -     foreach ($all as $thisitem)
> +     $hiermanager = cmsms()->GetHierarchyManager();

suggesting that expandall is now done in a different way. The source
code says:

> $lang['admin']['expandall'] = 'Expand All Sections';

so maybe it's possible that incorrect expandall behavior has some
relationship to the visibility of private "Section headers" referenced
in 8807. In other words, if expandall is done unsafely, maybe the
information produced later by the display_content_list function can
contain unintended section headers if there's a URL manipulation
(adding "&expandall=1" or whatever). If any of this is relevant (and,
quite possibly, it's not), this would seem consistent with the
vendor's "minor security issue" wording.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJSwYteAAoJEKllVAevmvmsHPkH/iPq6iwsAwATjeernEUqi7oF
Apsc6ZwlirR+QY742Na4S6pjdweOjfcpmC1r3JcomPykVr1aLb372OrwVU7h6Kk+
39W8iRI+A28DTj4QyHXr9x+tdq4h8f1E8CxLA0HflqJCZ3eMOa4deGvArQnxs9nC
LPxpW/Remn+nARkNJE0W2pUr6CjLN3hrJwtGk1Lu8SUg39V8E26A+hWiVdkPxk9g
dJ5wyuBktIuX3zM8VOs0I6GJVHddr0+ROxC9Ubue+2AaKMwr6XbSWgm0OmLtJhmc
c1WU17ukL+ygVEeO1iWqSmD9/7x50g9Hc4w++lqAqsn3WSEydID2Hq5FuO3VDVA=
=GyJT
-----END PGP SIGNATURE-----