GitHub Advisoryadvisory · Packagist

GHSA-wr23-m9m2-jjf4 Bolt Improper Access Control

MEDIUM Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2017-16754
Ecosystem
Packagist
Packages
bolt/bolt
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-732
Reviewed
2024-04-23

Affected packages

• Packagist bolt/bolt: < 3.3.6 → fixed in 3.3.6

Description

Bolt before 3.3.6 does not properly restrict access to `_profiler` routes, related to `EventListener/ProfilerListener.php` and `Provider/EventListenerServiceProvider.php`.

Related

Alias · CVE (1)

  • CVE-2017-16754 Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References