TSA 2009-12/1

Published by AlexC, Dec 14, 2009

Media items uploaded through the media module were accessible outside of TangoCMS, allowing users to bypass the ACL security checks by simply sharing a URL to the file.

Affected versions:

< 2.4.0

Related bug report:

Security #188

Solution:

Upgrade to 2.4.0 or later