GHSA-vx6j-pjrh-vgjh

Source

https://github.com/advisories/GHSA-vx6j-pjrh-vgjh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-vx6j-pjrh-vgjh/GHSA-vx6j-pjrh-vgjh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vx6j-pjrh-vgjh

Aliases

CVE-2021-43836

Published

2021-12-15T22:54:20Z

Modified

2023-11-08T04:07:13.976875Z

Severity

8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

PHP file inclusion in the Sulu admin panel

Details

Impact

What kind of vulnerability is it? Who is impacted?

An attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution.

Compromised components: Arbitrary file read on the server, (Potential) Remote code execution
Exploitation pre-requisite: User account on the backend

Patches

Has the problem been patched? What versions should users upgrade to?

The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.

References

Are there any links users can visit to find out more?

Currently not.

For more information

If you have any questions or comments about this advisory: * Open an issue in example link to repo * Email us at example email address

Database specific

{
    "nvd_published_at": "2021-12-15T20:15:00Z",
    "github_reviewed_at": "2021-12-15T22:27:31Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Packagist / sulu/sulu

Package

Name: sulu/sulu
Purl: pkg:composer/sulu/sulu

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.44

Affected versions

0.*

0.1.0

0.1.1

0.2.0

0.3.0

0.4.0

0.5.0

0.6.0

0.6.1

0.6.2

0.6.3

0.6.4

0.6.5

0.6.6

0.6.7

0.6.8

0.7.0

0.7.1

0.8.0

0.8.1

0.8.2

0.8.3

0.8.4

0.8.5

0.8.6

0.9.0

0.10.0

0.10.1

0.10.2

0.11.0

0.11.1

0.11.2

0.12.0

0.13.0

0.13.1

0.13.2

0.14.0

0.14.1

0.14.2

0.15.0

0.15.1

0.15.2

0.15.3

0.16.0

0.16.1

0.16.2

0.17.0-RC1

0.17.0-RC2

0.17.0

0.18.0

0.18.1

0.18.2

1.*

1.0.0-RC1

1.0.0-RC2

1.0.0-RC3

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.1.0-beta1

1.1.0-RC1

1.1.0-RC2

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.1.10

1.1.11

1.1.12

1.2.0-RC1

1.2.0-RC2

1.2.0-RC3

1.2.0-RC4

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3.0-RC1

1.3.0-RC2

1.3.0-RC3

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.3.10

1.3.11

1.4.0-RC1

1.4.0-RC2

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.4.10

1.4.11

1.4.12

1.5.0-RC1

1.5.0-RC2

1.5.0-RC3

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.5.10

1.5.11

1.5.12

1.5.13

1.5.14

1.5.15

1.5.16

1.5.17

1.5.18

1.5.19

1.5.20

1.5.21

1.5.22

1.5.23

1.5.24

1.6.0-RC1

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.6.10

1.6.11

1.6.12

1.6.13

1.6.14

1.6.15

1.6.16

1.6.17

1.6.18

1.6.19

1.6.20

1.6.21

1.6.22

1.6.23

1.6.24

1.6.25

1.6.26

1.6.27

1.6.28

1.6.29

1.6.30

1.6.31

1.6.32

1.6.33

1.6.34

1.6.35

1.6.36

1.6.37

1.6.38

1.6.39

1.6.40

1.6.41

1.6.42

1.6.43

Packagist / sulu/sulu

Package

Name: sulu/sulu
Purl: pkg:composer/sulu/sulu

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.2.18

Affected versions

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

2.1.0-RC1

2.1.0-RC2

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.2.0-RC1

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.2.10

2.2.11

2.2.12

2.2.13

2.2.14

2.2.15

2.2.16

2.2.17

Packagist / sulu/sulu

Package

Name: sulu/sulu
Purl: pkg:composer/sulu/sulu

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.0

Fixed

2.3.8

Affected versions

2.*

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

Packagist / sulu/sulu

Package

Name: sulu/sulu
Purl: pkg:composer/sulu/sulu

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4.0-RC1

Fixed

2.4.0

Affected versions

2.*

2.4.0-RC1