GHSA-84px-q68r-2fc9

Suggest an improvement
Source
https://github.com/advisories/GHSA-84px-q68r-2fc9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-84px-q68r-2fc9/GHSA-84px-q68r-2fc9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-84px-q68r-2fc9
Aliases
Published
2021-12-15T22:55:16Z
Modified
2023-11-08T04:07:13.915585Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Privilege escalation in the Sulu Admin panel
Details

Impact

Impacted are only users which already have access to the admin UI. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction.

Patches

The versions have been patched in 2.2.18, 2.3.8 and 2.4.0.

Workarounds

Patching the ProfileController of affected sulu versions yourself by overwriting it.

References

Are there any links users can visit to find out more?

Currently not.

For more information

If you have any questions or comments about this advisory: * Open an issue in sulu/sulu repo * Email us at security@sulu.io

Database specific 
{
    "nvd_published_at": "2021-12-15T20:15:00Z",
    "github_reviewed_at": "2021-12-15T22:27:38Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-269"
    ]
}
References

Affected packages

Packagist / sulu/sulu

Package

Name
sulu/sulu
Purl
pkg:composer/sulu/sulu

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.2.18

Affected versions

2.*

2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.0.10
2.0.11
2.0.12
2.1.0-RC1
2.1.0-RC2
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.2.0-RC1
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17

Database specific 

{
    "last_known_affected_version_range": "<= 2.2.17"
}

Packagist / sulu/sulu

Package

Name
sulu/sulu
Purl
pkg:composer/sulu/sulu

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.3.0
Fixed
2.3.8

Affected versions

2.*

2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7

Database specific 

{
    "last_known_affected_version_range": "<= 2.3.7"
}

Packagist / sulu/sulu

Package

Name
sulu/sulu
Purl
pkg:composer/sulu/sulu

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.4.0-RC1
Fixed
2.4.0

Affected versions

2.*

2.4.0-RC1