CyberRota Analysis
AI-GeneratedCraft CMS versions prior to 5.10.12 are vulnerable due to an information disclosure flaw in the AssetsController::actionMoveInfo, which improperly enforces volume permissions. This allows authenticated control panel users to exploit the assets/move-info endpoint, potentially revealing asset counts and total storage sizes for restricted volumes. Organizations using affected Craft CMS versions should prioritize patching to mitigate the risk of unauthorized information exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.