[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201312301506.rBUF68PW028543@linus.mitre.org>
Date: Mon, 30 Dec 2013 10:06:08 -0500 (EST)
From: cve-assign@...re.org
To: henri@...v.fi
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: cmsmadesimple before 1.11.8 / bad upstream behaviour vs. CVE assignment
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Can we get this assigned?
> Diff between 1.11.7 and 1.11.8: http://paste.nerv.fi/61005941.txt
The paste includes:
> +Version 1.11.8 - Fioreana
> +Core - Bug Reports
> + - #8807 Section headers are accessible through changing URL
Does anyone here have a dev.cmsmadesimple.org account (possibly
available through http://dev.cmsmadesimple.org/signup registration)
and want to comment on the contents of 8807?
(A CVE assignment based solely on "a minor security issue" is not
impossible, but checking the listed bug numbers first is often
useful.)
MITRE, in general, can't take responsibility for doing original
research on every diff of every product to determine what changes are
vulnerability fixes. Possibly we, or others, could suggest a guess in
case someone more familiar with the product can quickly confirm or
reject that. So, here is a guess offered with VERY LOW confidence:
The paste also includes:
> function expandall()
> {
> $userid = get_userid();
> - $contentops = cmsms()->GetContentOperations();
> - $all = $contentops->GetAllContent(false);
> - $cs = '';
> - foreach ($all as $thisitem)
> + $hiermanager = cmsms()->GetHierarchyManager();
suggesting that expandall is now done in a different way. The source
code says:
> $lang['admin']['expandall'] = 'Expand All Sections';
so maybe it's possible that incorrect expandall behavior has some
relationship to the visibility of private "Section headers" referenced
in 8807. In other words, if expandall is done unsafely, maybe the
information produced later by the display_content_list function can
contain unintended section headers if there's a URL manipulation
(adding "&expandall=1" or whatever). If any of this is relevant (and,
quite possibly, it's not), this would seem consistent with the
vendor's "minor security issue" wording.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJSwYteAAoJEKllVAevmvmsHPkH/iPq6iwsAwATjeernEUqi7oF
Apsc6ZwlirR+QY742Na4S6pjdweOjfcpmC1r3JcomPykVr1aLb372OrwVU7h6Kk+
39W8iRI+A28DTj4QyHXr9x+tdq4h8f1E8CxLA0HflqJCZ3eMOa4deGvArQnxs9nC
LPxpW/Remn+nARkNJE0W2pUr6CjLN3hrJwtGk1Lu8SUg39V8E26A+hWiVdkPxk9g
dJ5wyuBktIuX3zM8VOs0I6GJVHddr0+ROxC9Ubue+2AaKMwr6XbSWgm0OmLtJhmc
c1WU17ukL+ygVEeO1iWqSmD9/7x50g9Hc4w++lqAqsn3WSEydID2Hq5FuO3VDVA=
=GyJT
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
