NVD Vulnerability Detail

CVE-2019-16409

Summary	In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the upgrade process automates the destruction of these insecure artefacts, nor alerts the user to the criticality of destruction.)
Publication Date	Sept. 27, 2019, 1:15 a.m.
Registration Date	Jan. 26, 2021, 11:39 a.m.
Last Update	Nov. 21, 2024, 1:30 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:symbiote:versionedfiles::::::silverstripe::*		2.0.3
cpe:2.3:a:silverstripe:silverstripe::::::::	3.0.0	3.7.4

Related information, measures and tools

No	URL	タグ
1	https://github.com/silverstripe/silverstripe-framework	Product Third Party Advisory
2	https://github.com/silverstripe/silverstripe-framework	Product Third Party Advisory
3	https://github.com/symbiote/silverstripe-versionedfiles	Product Third Party Advisory
4	https://github.com/symbiote/silverstripe-versionedfiles	Product Third Party Advisory
5	https://www.silverstripe.org/download/security-releases/cve-2019-16409	Vendor Advisory
6	https://www.silverstripe.org/download/security-releases/cve-2019-16409	Vendor Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Versioned Files モジュールおよび SilverStripe における情報漏えいに関する脆弱性

Title	Versioned Files モジュールおよび SilverStripe における情報漏えいに関する脆弱性
Summary	Versioned Files モジュールおよび SilverStripe には、情報漏えいに関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 24, 2019, midnight
Registration Date	Oct. 2, 2019, 6:01 p.m.
Last Update	Oct. 2, 2019, 6:01 p.m.

Affected System

SilverStripe

SilverStripe 3.x

Symbiote

Versioned Files 2.0.3 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-16409	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16409
National Vulnerability Database (NVD)
2	CVE-2019-16409	https://nvd.nist.gov/vuln/detail/CVE-2019-16409
SilverStripe
3	CVE-2019-16409 secureassets and versionedfiles modules can expose versions of protected files	https://www.silverstripe.org/download/security-releases/cve-2019-16409

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
GitHub
1	SilverStripe Framework	https://github.com/silverstripe/silverstripe-framework
2	SilverStripe Versioned Files Module	https://github.com/symbiote/silverstripe-versionedfiles

Change Log

No	Changed Details	Date of change
1	[2019年10月02日] 掲載	Oct. 2, 2019, 6:01 p.m.