Blesta 3.0.6 Patch Released
A patch has been released for Blesta that addresses bugs discovered since 3.0.5 was released. As usual, a big thanks to everyone who reported and confirmed these bugs on our forums, we appreciate your help.
You can read more information about this patch, including the release notes, on our forums at http://www.blesta.com/forums/index.php?/topic/1467-release-306/
Download Link
To patch your installation, please follow the instructions for Patching an Existing Install from our user manual.
Blesta 3.0.5 Patch Released
A patch has been released for Blesta that addresses bugs discovered since 3.0.4 was released. It also contains two security fixes discovered in house as part of our review process. For more information about these fixes, please see the advisory. We strongly recommend upgrading to 3.0.5.
You can read more information about this patch, including the release notes, on our forums at http://www.blesta.com/forums/index.php?/topic/1285-release-305/
To patch your installation, please follow the instructions for Patching an Existing Install from our user manual.
Security Advisory - Plugin vulnerabilities
Affected Versions
Versions 3.0.0 through 3.0.4 are affected.
Description
Some content may be rendered in both the System Overview and Feed Reader plugins without proper sanitization, making them vulnerable to cross-site scripting (XSS) attacks. Patch release 3.0.5 corrects these vulnerabilities. Uninstalling the affected plugins will also mitigate any potential attacks.
Resolution
Upgrade to version 3.0.5, or uninstall the affected plugins. Related tasks:
- CORE-829
- CORE-830
Credits
These issues were discovered by the Blesta Development Team.
Related Tags:
Blesta 3.0.4 Patch Released
A patch has been released for Blesta that addresses bugs discovered since 3.0.3 was released and fixes two security related issues. We strongly recommend upgrading to 3.0.4.
You can read more information about this patch, including the release notes, on our forums at http://www.blesta.com/forums/index.php?/topic/1192-release-304/.
To patch your installation, please follow the instructions for Patching an Existing Install from our user manual. Don’t forget to run /admin/upgrade after you patch your files, there are some database changes that need to be executed.
Security Advisory – Cross-site scripting vulnerabilities
Affected Versions
Versions 3.0.0 through 3.0.3 are affected.
Description
Some messages may be rendered without proper sanitization, making the system vulnerable to cross-site scripting (XSS) attacks through carefully crafted URLs. Two distinct message types are vulnerable to such an attack. Disabling PHP error reporting mitigates one of these vectors. Both issues are fully resolved in patch release 3.0.4.
Resolution
Upgrade to version 3.0.4. Related tasks:
- CORE-796
- CORE-797
Credits
Thanks to Vlad C. of NetSec Interactive Solutions for reporting these issues.