GitHub Advisoryadvisory · Packagist

GHSA-hx6g-q9v2-xh7v Information exposure in elgg

HIGH Published 2021-12-16 Modified 2021-12-06 Official page ↗
Aliases
CVE-2021-3980
Ecosystem
Packagist
Packages
elgg/elgg
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-359
Reviewed
2021-12-06

Affected packages

• Packagist elgg/elgg: < 3.3.23 → fixed in 3.3.23 • Packagist elgg/elgg: >= 4.0.0, < 4.0.5 → fixed in 4.0.5

Description

elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Forms in the view namespace 'forms/admin' were not protected by an AdminGatekeeper in case of AJAX requests to 'ajax/form/admin/'.

Related

Alias · CVE (1)

  • CVE-2021-3980 elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor vulnerability

Weakness · CWE (1)

  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor weakness

References