In breve
- CVE-2023-22728 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda silverstripe/framework, framework (silverstripe).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.49%, superiore al 41.8% delle vulnerabilità.
- Correzione: aggiornare a 4.12.5 o successiva.
Description
The GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access.
Upgrade to silverstripe/framework 4.12.5 or above to address the issue.
Reported by Stephan Bauer from relaxt Webdienstleistungsagentur GmbH
NVD description
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free