PT-2024-23108 · Silverstripe · Silverstripe/Reports

Fiona Black + 1 · Published 2024-07-17 · Updated 2024-07-18 · CVE-2024-29885

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions silverstripe/reports versions prior to 5.2.3

Description The issue allows reports to be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false.

Recommendations For versions prior to 5.2.3, upgrade to version 5.2.3 to resolve the issue. As a temporary workaround, consider restricting access to the reports admin section to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

CVE-2024-29885

GHSA-89Q6-98XX-4FFW

Affected Products

Silverstripe/Reports

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29885.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/reports/CVE-2024-29885.yaml · Exploit
• https://github.com/silverstripe/silverstripe-reports/security/advisories/GHSA-89q6-98xx-4ffw · Vendor Advisory
• https://github.com/silverstripe/silverstripe-reports/commit/0351106c18ad4246d983b5f4e082c09c382121f4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-29885 · Security Note
• https://silverstripe.org/download/security-releases/cve-2024-29885 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29885 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-89q6-98xx-4ffw · Vendor Advisory
• https://github.com/silverstripe/silverstripe-reports · Note
• https://t.me/cvedetector/1126 · Telegram Post