CVE-2021-39458

Name of the Vulnerable Software and Affected Versions: Yakamara Media Redaxo CMS version 5.12.1

Description: Triggering an error page of the import process in the CMS allows an authenticated user to alter the files of a valid file backup, leading to the leakage of database credentials in the environment variables.

Recommendations: For Yakamara Media Redaxo CMS version 5.12.1, consider restricting access to the import process to prevent authenticated users from triggering the error page and altering file backups until a fix is available. As a temporary workaround, restrict the ability of authenticated CMS users to access and modify backup files to minimize the risk of database credential leakage.