CVE-2019-14280

EPSS 8.0%

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.htmlunverified exploitdbwww.exploit-db.com/exploits/47343unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/154276/Craft-CMS-2.7.9-3.2.5-Information-Disclosure.html https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23 https://github.com/craftcms/cms/blob/develop-v2/CHANGELOG-v2.md#2710---2019-07-24