Several security issues affecting Blesta versions 6.0.0 through 6.0.2 have been identified. These issues are resolved in the 6.0.3 patch release. This release also includes security hardening.
Details of these issues are undisclosed at this time. Individual issues range in severity, but we give this an overall impact rating of High based on the most severe issue. We recommend applying the 6.0.3 patch, or upgrading to version 6.0.3 as soon as possible.
More information about how we rate vulnerabilities can be found on our Security Advisories page.
Always back up your files and database prior to upgrading and be sure to run /admin/upgrade in your browser or via CLI after uploading either a patch or full release. Patch releases may only be applied to the minor release to which it belongs. Only apply the 6.0.3 patch if you are running 6.0.0, 6.0.1, or 6.0.2.
Affected Versions
Versions 6.0.0 through 6.0.2 are affected.
Downloads
The 6.0.3 patch and full release, along with their SHA256 sums, are available from the Blesta 6.0.3 Patch Released announcement.
Resolution
- If you are running version 6.0.x, apply the 6.0.3 patch.
- If you are running an earlier version, upgrade to 6.0.3 Full.
The full release notes are available at https://docs.blesta.com/support/releases/6/603/.
Credits
Several issues were reported by kta1kri and Hypefox AB in accordance with our Responsible Disclosure Policy. Additional issues were discovered internally.