CVE-2022-29784 (published 2022-06-03T21:15Z)

PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/sanluan/PublicCMS
commit_details: repo_url: https://github.com/sanluan/PublicCMS
author: sanluan
author_date: 2022-04-22 19:14:05+08:00
msg: 安全漏洞修复 感谢 姜洋-长亭科技
repository: repo_url: https://github.com/sanluan/PublicCMS
repo_name: sanluan/PublicCMS
description: More than 2 million lines of code modification continuously iterated for 7 years to modernize java cms, easily supporting tens of millions of data, tens of millions of PV; Support static, server side includes; Currently has 0.0005% of the world's users (w3techs provided data), language support in Chinese, Japanese, English
repo_language: Java
owner: sanluan
file_changes: filename: build.gradle
change_type: ModificationType.MODIFY
diff: @@ -23,7 +23,7 @@ subprojects {
     apply plugin: "eclipse-wtp"
 
     group = 'com.publiccms'
-    version = 'V4.0.202204.a'
+    version = 'V4.0.202204.b'
     
     test.enabled = false
     

programming_language: Markdown
filename: pom.xml
change_type: ModificationType.MODIFY
diff: @@ -22,7 +22,7 @@
         <maven.compiler.source>${java.version}</maven.compiler.source>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven.compiler.encoding>UTF-8</maven.compiler.encoding>
-        <version.publiccms>V4.0.202204.a</version.publiccms>
+        <version.publiccms>V4.0.202204.b</version.publiccms>
         <!-- http://mvnrepository.com/artifact/org.springframework/spring-core -->
         <!-- https://spring.io/projects/spring-framework -->
         <version.spring>5.3.19</version.spring>

programming_language: HTML
filename: CmsVersion.java
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,7 @@ public class CmsVersion {
      * @return revision
      */
     public static final String getRevision() {
-        return "a";
+        return "b";
     }
 
     /**

programming_language: Java
filename: SysConfigDataDirective.java
change_type: ModificationType.MODIFY
diff: @@ -50,6 +50,11 @@ public class SysConfigDataDirective extends AbstractTemplateDirective {
         }
     }
 
+    @Override
+    public boolean needAppToken() {
+        return true;
+    }
+
     @Autowired
     private SysConfigDataService service;
 

programming_language: Java
filename: SysDatasourceDirective.java
change_type: ModificationType.MODIFY
diff: @@ -45,6 +45,11 @@ public class SysDatasourceDirective extends AbstractTemplateDirective {
         }
     }
 
+    @Override
+    public boolean needAppToken() {
+        return true;
+    }
+
     @Autowired
     private SysDatasourceService service;
 

programming_language: Java