Craft CMS Google Cloud Storage Plugin Unauthenticated Bucket Listing Vulnerability
Vulnerability
A low-severity information disclosure vulnerability exists in the Google Cloud Storage for Craft CMS plugin, specifically in versions 2.0.0-beta.1 through 2.2.0. The issue arises in the DefaultController's actionLoadBucketData() endpoint, which allows unauthenticated users with a valid CSRF token to access a list of buckets that the plugin can view.
Impact
Exploitation of this vulnerability allows for unauthorized access to bucket information, potentially leading to further information disclosure or misuse of the Google Cloud Storage integration.
Remediation
Users are advised to update the Google Cloud Storage for Craft CMS plugin to version 2.2.1.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.