GitHub Advisoryadvisory · Packagist

GHSA-52cx-hpc5-cxwc silverstripe/framework missing ACL on reports

MEDIUM Published 2024-05-27 Modified 2024-05-27 Official page ↗
Ecosystem
Packagist
Packages
silverstripe/framework
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2024-05-27

Affected packages

• Packagist silverstripe/framework: >= 3.1.19-rc1, < 3.1.20 → fixed in 3.1.20 • Packagist silverstripe/framework: >= 3.2.4-rc1, < 3.2.5 → fixed in 3.2.5 • Packagist silverstripe/framework: >= 3.3.2-rc1, < 3.3.3 → fixed in 3.3.3 • Packagist silverstripe/framework: >= 3.4.0-rc1, < 3.4.1 → fixed in 3.4.1

Description

The SS_Report, and the reports CMS section only checks `canView()` when listing the reports that can be viewed by the current user. It does not (and should) perform `canView` checks when the report is actually viewed, so if you know the URL to a report and can otherwise access the Reports section of the CMS, you can view any report.

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References