PT-2022-19882 · Silverstripe · Silverstripe/Assets

Ranjit-Git · Published 2022-06-28 · Updated 2022-07-08 · CVE-2022-29858

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe silverstripe/assets versions through 1.10

Description The issue is related to improper access control, allowing protected images to be published by changing an existing image short code on website content. Specifically, draft protected images can be published by modifying the existing image shortcode to match the ID of the draft protected image and then publishing the website content.

Recommendations For versions through 1.10, consider restricting access to the image shortcode feature until a patch is available. As a temporary workaround, avoid using the image shortcode to publish draft protected images. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-29858

GHSA-V68G-62V9-39W5

Affected Products

Silverstripe/Assets

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2022-29858.yaml · Exploit
• 🔥 https://huntr.dev/bounties/90e17d95-9f2f-44eb-9f26-49fa13a41d5a · Exploit
• https://github.com/silverstripe/silverstripe-assets/commit/5f6a73b010c01587ffbfb954441f6b7cbb54e767 · Patch
• https://silverstripe.org/download/security-releases/cve-2022-29858 · Vendor Advisory
• https://forum.silverstripe.org/c/releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29858 · Security Note
• https://silverstripe.org/blog/tag/release · Vendor Advisory
• https://silverstripe.org/download/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v68g-62v9-39w5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29858 · Vendor Advisory
• https://t.me/cibsecurity/45344 · Telegram Post
• https://t.me/cvenotify/32328 · Telegram Post
• https://t.me/cvenotify/32761 · Telegram Post