PT-2024-40287 · Neos · Neos

Published 2024-06-05 · Updated 2024-06-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: Neos (affected versions not specified)

Description: The issue allows unauthorized access to internal workspaces in Neos without authentication. This means that internal workspaces, which are non-public and do not have an owner, can be viewed by anyone who knows the workspace name, including a unique hash. The impact is somewhat mitigated because there is no default internal workspace, and an attacker would need to guess or brute-force the workspace name, which includes a hash. The issue only allows reading of internal workspaces, not writing.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-G4XV-R3QW-V3Q2

Affected Products

Neos

References · 4

• https://osv.dev/vulnerability/GHSA-g4xv-r3qw-v3q2 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/neos/2019-06-17.yaml · Note
• https://github.com/mneuhaus/TYPO3.Neos · Note
• https://neos.io/blog/neos-workspace-disclosure-security.html · Note