Skip to content
Threat Feed
Subscribe

Product

Craft CMS (< 5.10.12)

1 brief RSS
high advisory

Authorization Bypass in Craft CMS assets/move-asset Endpoint

Craft CMS versions prior to 5.10.11 contain an authorization bypass in the assets/move-asset endpoint, allowing authenticated users with insufficient permissions to move and delete arbitrary assets by supplying the force=1 parameter.

Craft CMS +3 cms web-vulnerability authorization-bypass web-application vulnerability privilege-escalation web-application-vulnerability rce +1
2r 4t 1c updated