GitHub Advisoryadvisory · Packagist

GHSA-32rx-xvvr-4xv9 easyadmin-extension-bundle action case insensitivity

HIGH Published 2024-05-15 Modified 2024-05-15 Official page ↗

Ecosystem: Packagist
Packages: alterphp/easyadmin-extension-bundle
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Reviewed: 2024-05-15

Affected packages

• Packagist alterphp/easyadmin-extension-bundle: >= 1.3.0, < 1.3.1 → fixed in 1.3.1 • Packagist alterphp/easyadmin-extension-bundle: >= 1.2.0, < 1.2.11 → fixed in 1.2.11

Description

In alterphp/easyadmin-extension-bundle, role based access rules do not handle action name case sensitivity which may lead to unauthorized access.

References

https://github.com/alterphp/EasyAdminExtensionBundle/commit/68407ca5be644d1c53fb894453df951230afc6dc web
https://github.com/FriendsOfPHP/security-advisories/blob/master/alterphp/easyadmin-extension-bundle/2018-10-02.yaml web
https://github.com/alterphp/EasyAdminExtensionBundle/releases/tag/v1.3.1 web