PT-2017-12004 · Statamic · Statamic

Published 2017-07-24 · Updated 2022-05-13 · CVE-2017-11422

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Statamic framework versions prior to 2.6.0

Description The issue arises from incorrect permission checking for sessions when methods from a user's class are invoked. This affects various methods, including resetPassword(), createNewAccount(), and createNewRole().

Recommendations For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-11422

GHSA-5M64-9HQ5-5PF2

Affected Products

Statamic

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-11422 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11422 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5m64-9hq5-5pf2 · Vendor Advisory
• https://gist.github.com/rambo691/3714c8c09cf894d574d37c294711c49e · Note