Description
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. This issue has been patched in versions 4.17.8 and 5.9.14.
Remediation
References
Related Vulnerabilities
WordPress Plugin ChikunCount Arbitrary File Upload (1.3)
Drupal Core 9.0.x Cross-Site Request Forgery (9.0.0 - 9.0.14)
WordPress Plugin Active Directory Authentication Integration Cross-Site Scripting (0.6)
MediaWiki CVE-2022-28205 Vulnerability (CVE-2022-28205)
WordPress Plugin PhotoXhibit Multiple Cross-Site Scripting Vulnerabilities (2.1.8)