GitHub Advisoryadvisory · Packagist
GHSA-v68g-62v9-39w5 Unpublished, protected files can be published via shortcode
MEDIUM
Official page ↗
- Aliases
- CVE-2022-29858
- Ecosystem
- Packagist
- Packages
- silverstripe/assets
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-287
- Reviewed
- 2022-06-29
Affected packages
• Packagist silverstripe/assets: >= 1.0.0, < 1.10.1 → fixed in 1.10.1
Description
Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content. Draft protected images can be published by changing an existing image shortcode on website content to match the ID of the draft protected image and then publishing the website content.
Related
Alias · CVE (1)
- CVE-2022-29858 Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by… vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-29858 advisory
- https://github.com/silverstripe/silverstripe-assets/commit/5f6a73b010c01587ffbfb954441f6b7cbb54e767 web
- https://forum.silverstripe.org/c/releases web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2022-29858.yaml web
- https://huntr.dev/bounties/90e17d95-9f2f-44eb-9f26-49fa13a41d5a web
- https://www.silverstripe.org/blog/tag/release web
- https://www.silverstripe.org/download/security-releases web
- https://www.silverstripe.org/download/security-releases/cve-2022-29858 web