Threats Tagged 'ghsa-fq6c-26cc-63cr'

Craft CMS versions 5.0.0 through 5.10.12 have a vulnerability where a database connection failure causes the system to treat the site as uninstalled. This exposes installer actions to unauthenticated users who have a valid guest session and CSRF token from before the outage. Attackers can exploit this to disclose sensitive environment variables and secrets such as security keys and database credentials. The vulnerability requires an independent database outage and is fixed in version 5.10.13.