PT-2024-40044 · Neos · Neos

Published 2024-05-17 · Updated 2024-05-17

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Neos (affected versions not specified)

Description The issue allows unauthorized access to internal workspaces in Neos without authentication. This means that internal workspaces, which are non-public and do not have an owner, can be viewed by anyone who knows the workspace name, including a unique hash. The impact is somewhat mitigated because there is no default internal workspace, so only user-created workspaces are affected. An attacker would need to obtain the workspace name, including the hash, to exploit the issue. This can be done through brute force or educated guesses, although it is not a trivial task.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-3C5G-73F7-GRVM

Affected Products

Neos

References · 4

• https://osv.dev/vulnerability/GHSA-3c5g-73f7-grvm · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/neos/neos/2019-06-17.yaml · Note
• https://github.com/neos/neos · Note
• https://neos.io/blog/neos-workspace-disclosure-security.html · Note