CVE-2019-12902 Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data.
MediumCVSS 6.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pydio github.com/pydio/cells | < 1.5.0 | 1.5.0 |
References
- pydio.com vendor-advisory
- research.loginsoft.com release-notes third-party-advisory