GHSA-89q6-98xx-4ffwMediumCVSS 4.3
Silverstripe Reports are still accessible even when `canView()` returns false
🔗 CVE IDs covered (1)
📋 Description
Reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false.
References
- https://www.silverstripe.org/download/security-releases/cve-2024-29885
🎯 Affected products1
- composer/silverstripe/reports:< 5.2.3
🔗 References (6)
- https://github.com/silverstripe/silverstripe-reports/security/advisories/GHSA-89q6-98xx-4ffw
- https://github.com/silverstripe/silverstripe-reports/commit/0351106c18ad4246d983b5f4e082c09c382121f4
- https://www.silverstripe.org/download/security-releases/cve-2024-29885
- https://nvd.nist.gov/vuln/detail/CVE-2024-29885
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/reports/CVE-2024-29885.yaml
- https://github.com/advisories/GHSA-89q6-98xx-4ffw