silverstripe/silverstripe-reports · Security
Silverstripe Reports are still accessible even when `canView()` returns false
- GHSA ID
- GHSA-89q6-98xx-4ffw
- CVE ID
- CVE-2024-29885
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v4
- 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false.
References
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- CWE-863 · Incorrect Authorization
References
- https://github.com/silverstripe/silverstripe-reports/security/advisories/GHSA-89q6-98xx-4ffw ↗
- https://github.com/silverstripe/silverstripe-reports/commit/0351106c18ad4246d983b5f4e082c09c382121f4 ↗
- https://www.silverstripe.org/download/security-releases/cve-2024-29885 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-29885 ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/reports/CVE-2024-29885.yaml ↗
- https://github.com/advisories/GHSA-89q6-98xx-4ffw ↗