GitHub Advisoryadvisory · Packagist
GHSA-89q6-98xx-4ffw Silverstripe Reports are still accessible even when `canView()` returns false
MEDIUM
Official page ↗
- Aliases
- CVE-2024-29885
- Ecosystem
- Packagist
- Packages
- silverstripe/reports
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200, CWE-863
- Reviewed
- 2024-07-17
Affected packages
• Packagist silverstripe/reports: < 5.2.3 → fixed in 5.2.3
Description
Reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the `canView()` method for that report returns `false`.
References
• https://www.silverstripe.org/download/security-releases/cve-2024-29885
Related
Alias · CVE (1)
- CVE-2024-29885 silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. vulnerability
References
- https://github.com/silverstripe/silverstripe-reports/security/advisories/GHSA-89q6-98xx-4ffw web
- https://nvd.nist.gov/vuln/detail/CVE-2024-29885 advisory
- https://github.com/silverstripe/silverstripe-reports/commit/0351106c18ad4246d983b5f4e082c09c382121f4 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/reports/CVE-2024-29885.yaml web
- https://github.com/silverstripe/silverstripe-reports package
- https://www.silverstripe.org/download/security-releases/cve-2024-29885 web