GHSA-hxcw-pqqc-rv85critical9.8
Anchor CMS Logs Credentials
Impact
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
anchorcms/anchor-cms Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 0.12.7Ecosystem versions | 0.12.7 |
Version evidence: OSV · GHSA-hxcw-pqqc-rv85
View original version evidence (13 explicit versions)
Original source description
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2018-7251
- Source reference github.com/anchorcms/anchor-cms/issues/1247
- Source reference github.com/anchorcms/anchor-cms
- Release notes github.com/anchorcms/anchor-cms/releases/tag/0.12.7
- Source reference twitter.com/finnwea/status/965279233030393856
- Public exploit reference packetstormsecurity.com/files/154723/Anchor-CMS-0.12.3a-Information-Disclosure.html
- Security advisory www.andmp.com/2018/02/advisory-assigned-CVE-2018-7251-in-anchorcms.html