Possible security issue when logged out

Support and Discussion General Discussion
1

Without logging in or when logged out, if you go to https://your.domain:8090/base/versionManagment, CP appears to provide a long page of server details with title " KeyError at /base/versionManagment". This appears to be a potential security issue.

Note: this occurs on vs 2.3.5 x64 and ARM Ubuntu 22.04. 2.3.4 does not and redirects to the login page as you would expect so looks like the issue occurs with the control panel update option.

@UsmanNasir can you check and confirm please.

2

I have just done a cli update and it has fixed the issue, it now redirects to the login page.

Version showing problem:
2.3
Build:
5
Commit:
e9a4cb2f56dab447487f7ebf208fdb2e357d79cc

Updated Version:
2.3
Build:
5
Commit:
63013ed8ccf8d30135b05cd24cd8c71a4b92198e

3

yes i fixed that yesterday.

4

@UsmanNasir is there somewhere to see what is fixed or updated with each commit?