PT-2024-13800 · Silverstripe · Silverstripe/Admin

Guysartorelli · Published 2024-01-23 · Updated 2024-02-02 · CVE-2023-49783

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe Admin versions 1.x prior to 1.13.19 Silverstripe Admin versions 2.x prior to 2.1.8

Description The issue allows users who don't have edit or delete permissions for records exposed in a ModelAdmin to still edit or delete records using the CSV import form, provided they have create permissions. The likelihood of a user having create permissions but not having edit or delete permissions is low, but it is possible. This doesn't affect any ModelAdmin which has had the import form disabled via the showImportForm public property.

Recommendations For Silverstripe Admin versions 1.x prior to 1.13.19, update to version 1.13.19 or later. For Silverstripe Admin versions 2.x prior to 2.1.8, update to version 2.1.8 or later. If you have a custom implementation of BulkLoader, update your implementation to respect permissions when the return value of getCheckPermissions() is true. If you are using any BulkLoader in your own project logic, or maintain a module which uses it, consider passing true to setCheckPermissions() if the data is provided by users.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-49783

GHSA-J3M6-GVM8-MHVW

Affected Products

Silverstripe/Admin

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49783.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/admin/CVE-2023-49783.yaml · Exploit
• https://github.com/silverstripe/silverstripe-admin/security/advisories/GHSA-j3m6-gvm8-mhvw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49783 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49783 · Vendor Advisory
• https://silverstripe.org/download/security-releases/CVE-2023-49783 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3m6-gvm8-mhvw · Vendor Advisory
• https://github.com/silverstripe/silverstripe-admin/commit/9693130a0a637cdf512277cf5f07e83250b191db · Note
• https://github.com/silverstripe/silverstripe-admin · Note
• https://t.me/cvenotify/69712 · Telegram Post
• ❌ https://github.com/silverstripe-security/security-issues/issues/177 · Note, Deleted
• https://t.me/cvenotify/68373 · Telegram Post
• ❌ https://github.com/silverstripeltd/product-issues/issues/832 · Note, Deleted