PT-2022-28258 · Islandora · Islandora

Published 2022-07-21 · Updated 2022-07-21

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Islandora versions 2.0 and greater

Description This issue allows any user to upload content into a repository, regardless of their permissions.

Recommendations For Islandora versions 2.0 and greater, upgrade immediately to the latest release of Islandora. As a temporary workaround, consider leveraging the module available at https://github.com/Islandora/islandora ghsa route fix to resolve the issue until an upgrade can take place.

Fix

Related Identifiers

GHSA-M58Q-QQ5H-MGQQ

Affected Products

Islandora

References · 5

• https://osv.dev/vulnerability/GHSA-m58q-qq5h-mgqq · Vendor Advisory
• https://github.com/Islandora/islandora/security/advisories/GHSA-m58q-qq5h-mgqq · Note
• https://github.com/Islandora/islandora/releases/tag/2.4.1 · Note
• https://github.com/Islandora/islandora/commit/573d6878edf057987f1e41e5068de0074573e4c7 · Note
• https://github.com/Islandora-CLAW/islandora · Note