GitHub Advisoryadvisory · Go
GHSA-mv7x-27pc-8c96 Go package pydio/cells vulnerable to authorization bypass
MEDIUM
Official page ↗
- Aliases
- CVE-2023-2978
- Ecosystem
- Go
- Packages
- github.com/pydio/cells
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-639
- Reviewed
- 2023-05-31
Affected packages
• Go github.com/pydio/cells: < 4.2.1 → fixed in 4.2.1
Description
A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifier assigned to this vulnerability.
Related
Alias · CVE (1)
- CVE-2023-2978 A vulnerability was found in Abstrium Pydio Cells 4.2.0. vulnerability
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-2978 advisory
- https://popalltheshells.medium.com/multiple-cves-affecting-pydio-cells-4-2-0-321e7e4712be web
- https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421 web
- https://vuldb.com/?ctiid.230210 web
- https://vuldb.com/?id.230210 web
- github.com/pydio/cells package