GitHub Advisoryadvisory · Packagist

GHSA-m58q-qq5h-mgqq Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository

CRITICAL Published 2022-07-21 Modified 2022-07-21 Official page ↗
Ecosystem
Packagist
Packages
islandora/islandora
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Reviewed
2022-07-21

Affected packages

• Packagist islandora/islandora: >= 2.0, < 2.4.1 → fixed in 2.4.1

Description

Impact This vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater. Patches Upgrade immediately to the latest release of Islandora. Workarounds In lieu of an upgrade the following module can be leveraged that will resolve the issue until such a time an upgrade can take place. For more information If you have any questions or comments about this advisory: • Open an issue in Islandora • Contact [email protected].

References