PT-2022-13270 · Publify · Publify

Published 2022-05-16 · Updated 2024-03-06 · CVE-2022-0574

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions publify/publify versions prior to 9.2.8

Description The issue concerns improper access control in the GitHub repository publify/publify. It allows anonymous users to leave comments on articles in draft mode, even though they cannot view these articles.

Recommendations For versions prior to 9.2.8, update to version 9.2.8 or later to resolve the issue.

Exploit

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

BIT-PUBLIFY-2022-0574

CVE-2022-0574

GHSA-79M3-Q3WH-C3QM

Affected Products

Publify

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0574.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/publify_core/CVE-2022-0574.yml · Exploit
• 🔥 https://huntr.dev/bounties/6f322c84-9e20-4df6-97e8-92bc271ede3f · Exploit
• https://github.com/publify/publify/commit/0e6c66ac2002136517662399bca9d838c80d9739 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-0574 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0574 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-79m3-q3wh-c3qm · Vendor Advisory
• https://osv.dev/vulnerability/BIT-publify-2022-0574 · Vendor Advisory
• https://github.com/publify/publify · Note
• https://t.me/cvenotify/30658 · Telegram Post