PT-2024-40051 · Silverstripe · Silverstripe Cms

Published 2024-05-22 · Updated 2024-05-22

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe CMS (affected versions not specified)

Description A vulnerability exists in the permission validation for SiteTree object creation, allowing users or unauthenticated guests to create new SiteTree objects in the database if they have CMS access or if another mechanism allows model editing and relies on model-level permission checks. This vulnerability is restricted to the creation of draft or live pages and does not allow users to edit, publish, or unpublish existing pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

GHSA-3MM9-2P44-RW39

Affected Products

Silverstripe Cms

References · 6

• https://osv.dev/vulnerability/GHSA-3mm9-2p44-rw39 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/cms/SS-2015-008-1.yaml · Note
• https://github.com/silverstripe/silverstripe-cms/commit/64955e57d1239975183f47d3ac8c3e801ddbf122 · Note
• https://github.com/silverstripe/silverstripe-cms/commit/3df41e1176385215f15fffb04fcba033a5151fb4 · Note
• https://github.com/silverstripe/silverstripe-cms · Note
• https://silverstripe.org/software/download/security-releases/ss-2015-008-sitetree-creation-permission-vulnerability · Note