Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view users, though the endpoint only exposed user existence and not any other user data. This issue is fixed in versions 5.74.1 and 6.24.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
statamic:cms
References 5
https://github.com/statamic/cms/commit/aea68053cedab5c79d10102820b57345a7d7102e
security-advisories@github.com
https://github.com/statamic/cms/pull/14905
security-advisories@github.com
https://github.com/statamic/cms/releases/tag/v5.74.1
security-advisories@github.com
https://github.com/statamic/cms/releases/tag/v6.24.0
security-advisories@github.com
https://github.com/statamic/cms/security/advisories/GHSA-225x-3jhx-wh4q
security-advisories@github.com