imported>Rvogel1 No edit summary |
imported>Rvogel1 No edit summary |
||
| (One intermediate revision by the same user not shown) | |||
| Line 5: | Line 5: | ||
|- | |- | ||
|Date | |Date | ||
|2026- | |2026-03-04 | ||
|- | |- | ||
|Severity | |Severity | ||
| Line 12: | Line 12: | ||
|Affected | |Affected | ||
| Services in LTS version < 5.1.5 | | Services in LTS version < 5.1.5 | ||
BlueSpice PRO/FARM < 5.1. | BlueSpice PRO/FARM < 5.1.4 | ||
BlueSpice PRO/FARM < 5.2.0 | BlueSpice PRO/FARM < 5.2.0 | ||
|- | |- | ||
| Line 40: | Line 41: | ||
|- | |- | ||
|CVE-2026-24732 | |CVE-2026-24732 | ||
| | |Extension:NSFileRepo | ||
|Information Disclosure | |Information Disclosure | ||
| style="" class="col-purple-bg" |affected | | style="" class="col-purple-bg" |affected | ||
| Line 53: | Line 54: | ||
|- | |- | ||
| style="vertical-align:middle;text-align:left;" |CVE-2025-15467 | | style="vertical-align:middle;text-align:left;" |CVE-2025-15467 | ||
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Low | | style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Low, as by default configuration of <code>bluespice-deploy</code>, this is not exploitable | ||
| style="vertical-align:middle;text-align:left;" |Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups | | style="vertical-align:middle;text-align:left;" |Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups | ||
|- | |- | ||
|CVE-2026-24732 | |CVE-2026-24732 | ||
| style="" class="col- | | style="" class="col-orange-bg" |Low, as by default configuration of BlueSpice MediaWiki, this is not exploitable. The affected type of configuration is considered an edge-case. | ||
| | |Make sure <code>$wgGroupPermissions['*']['read']</code> is set to <code>false</code> in the <code>LocalSettings.php</code>. | ||
|} | |} | ||
== Solution == | == Solution == | ||
Update to BlueSpice 5.1.4+ or 5.2.1+ | |||
Latest revision as of 15:32, 4 March 2026
| Date | 2026-03-04 |
| Severity | reported "high", BlueSpice assessment: low |
| Affected | Services in LTS version < 5.1.5
BlueSpice PRO/FARM < 5.1.4 BlueSpice PRO/FARM < 5.2.0 |
| Fixed in | BlueSpice PRO/FARM 5.1.4
BlueSpice PRO/FARM 5.2.1 |
| CVE |
Problem
| CVE | Component | Type of vulnerability | BlueSpice 5 | BlueSpice 4 |
|---|---|---|---|---|
| CVE-2025-15467 | Container bluespice/database |
Buffer Overflow | affected | affected |
| CVE-2026-24732 | Extension:NSFileRepo | Information Disclosure | affected | not affected |
Impact assessment
| CVE | Assessment | Mitigation without update |
|---|---|---|
| CVE-2025-15467 | Low, as by default configuration of bluespice-deploy, this is not exploitable |
Make sure the service has no access to the internet. This is the default configuration of BlueSpice setups |
| CVE-2026-24732 | Low, as by default configuration of BlueSpice MediaWiki, this is not exploitable. The affected type of configuration is considered an edge-case. | Make sure $wgGroupPermissions['*']['read'] is set to false in the LocalSettings.php. |
Solution
Update to BlueSpice 5.1.4+ or 5.2.1+
