CMS Made Simple Forums

What is the status on this?

Cheers, Christian.

The description is rather vague and I don't see how it can be a vulnerability.

Note that in general we don't consider it a vulnerability when an admin user can do admin things.

Please let me know if I'm missing something obvious.

I'm probably not the right person to judge the implications. But if the vulnerabilities are only applicable to logged in users in the admin or designer groups, I also fail to see the problem. Since these users will already be allowed execute more or less arbitrary php code through other means.

Thanks for the answer.

anthon wrote:I'm probably not the right person to judge the implications. But if the vulnerabilities are only applicable to logged in users in the admin or designer groups, I also fail to see the problem. Since these users will already be allowed execute more or less arbitrary php code through other means.

Thanks for the answer.

That's exactly what we understand from it too.
It's a pity those reports popup regularly but we don't have time to reply to every one of them (the 'invalid' ones I mean).

However, if you think we might have missed an important vulnerability it's ok to ask about it of course.

The different CVEs read rather nicely:
https://github.com/itodaro/cve/blob/master/README.md

You should at least consider adding the suggested fixes.
They are probably not really severe, but it would round up the upcoming version 2.3 just nicely