silverstripe/silverstripe-framework · Security
silverstripe/framework Privilege Escalation Risk in Member Edit form
- GHSA ID
- GHSA-xpff-c35g-j3cr
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Description
A member with the permission EDIT_PERMISSIONS and access to the "Security" section is able to re-assign themselves (or another member) to ADMIN level.
CMS Fields for the member are constructed using DirectGroups instead of Groups relation which results in bypassing security logic preventing privilege escalation.
CWEs
- CWE-268 · Privilege Chaining
References
- https://github.com/silverstripe/silverstripe-framework/commit/577138882163e4b8782ea043487944d30d88e753 ↗
- https://github.com/silverstripe/silverstripe-framework/commit/e409d6f673c49846086b23677aecdc3fde5fc4d5 ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-001-1.yaml ↗
- https://www.silverstripe.org/download/security-releases/ss-2018-001 ↗
- https://github.com/advisories/GHSA-xpff-c35g-j3cr ↗