PT-2024-40295 · Thelia · Thelia

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions thelia/thelia versions 2.1.0-beta1 through 2.1.2

Description An authentication bypass issue was identified, affecting both customer and admin authentication.

Recommendations For thelia/thelia versions 2.1.0-beta1 through 2.1.2, update to version 2.1.3 or 2.2.0-alpha1 to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

GHSA-G8PG-33V4-9R96

Affected Products

Thelia

References · 5

• https://osv.dev/vulnerability/GHSA-g8pg-33v4-9r96 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/thelia/thelia/2015-04-13-1.yaml · Note
• https://github.com/thelia/thelia · Note
• https://github.com/thelia/thelia/commit/028cfcf507cd8685772e156ec0c860034d407094 · Note
• https://web.archive.org/web/20160502224630/http://thelia.net/version-2-1-3-with-security-fix · Note