Kurz gesagt
- CVE-2023-22728 ist eine Schwachstelle (MITTEL (CVSS 4.3)) in silverstripe/framework, framework (silverstripe).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.49%, höher als bei 41.8% aller Schwachstellen.
- Abhilfe: auf 4.12.5 oder neuer aktualisieren.
Description
The GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access.
Upgrade to silverstripe/framework 4.12.5 or above to address the issue.
Reported by Stephan Bauer from relaxt Webdienstleistungsagentur GmbH
NVD description
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free