[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] Magnolia CMS multiple access control vulnerabilities

Multiple access control vulnerabilities in Magnolia CMS, Community and
Enterprise editions


A non-admin user (such as default users eric / peter) can access and
execute multiple administrative functionalities of the CMS by
accessing directly the specific URLs.

Magnolia CMS

Magnolia International Ltd.

Affected versions:
Magnolia CMS <= 4.5.8
Tested on: 4.5.8, 4.5.7 and 4.5.3, both Community and Enterprise editions

Not-affected version:
Magnolia CMS 4.5.9

Product information:
Magnolia CMS is an open-source Web Content Management System that
focuses on providing an intuitive user experience in an
enterprise-scale system.

Vulnerability details:
The following functionalities can be accessed and executed by a
non-admin user based on the URL:

- View and set the log level of Magnolia

- Read Magnolia log files (can contain sensitive information)

- View Magnolia configuration:

- View permissions of Magnolia users. Also can be used for user enumeration

- Send arbitrary email messages

- View the list of installed modules

- Execute arbitrary queries in the repository (limited by the current
user's rights)

Vendor contact log:
2013-04-25: Contacting vendor through support@xxxxxxxxxxxxxxxx
2013-04-29: Vendor acknowledges the receipt of the advisory
2013-04-29: Vendor confirms the vulnerability
2013-06-03: Vendor releases version 4.5.9 which fixes the vulnerability

This vulnerability was discovered by Adrian Furtuna

Upgrade to the latest version of Magnolia CMS