GitHub Advisoryadvisory · RubyGems

GHSA-x24j-87x9-jvv5 Publify `guest` role users can self-register even when the admin does not allow it

MEDIUM Published 2021-11-03 Modified 2022-08-11 Official page ↗
Aliases
CVE-2021-25973
Ecosystem
RubyGems
Packages
publify_core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-285, CWE-669, CWE-863
Reviewed
2021-11-03

Affected packages

• RubyGems publify_core: >= 9.0.0.pre1, < 9.2.5 → fixed in 9.2.5

Description

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. `guest` role users can self-register even when the admin does not allow it. This happens due to front-end restriction only.

Related

Alias · CVE (1)

  • CVE-2021-25973 In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. vulnerability

Weakness · CWE (3)

  • CWE-285 Improper Authorization weakness
  • CWE-669 Incorrect Resource Transfer Between Spheres weakness
  • CWE-863 Incorrect Authorization weakness

References