What is GHSA-hx6g-q9v2-xh7v?

GHSA-hx6g-q9v2-xh7v is a security advisory published by GitHub Security Advisories with High severity. Information exposure in elgg

Which CVE IDs does GHSA-hx6g-q9v2-xh7v cover?

GHSA-hx6g-q9v2-xh7v covers the following CVE IDs: CVE-2021-3980. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hx6g-q9v2-xh7v?

GHSA-hx6g-q9v2-xh7v has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-hx6g-q9v2-xh7v?

GHSA-hx6g-q9v2-xh7v affects 2 products, including: composer/elgg/elgg:\u003c 3.3.23; composer/elgg/elgg:\u003e= 4.0.0, \u003c 4.0.5.

GHSA-hx6g-q9v2-xh7vHighCVSS 7.5

Information exposure in elgg

Vendor

GitHub Security Advisories

Published

December 16, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-3980 →

📋 Description

elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Forms in the view namespace 'forms/admin' were not protected by an AdminGatekeeper in case of AJAX requests to 'ajax/form/admin/'.

🎯 Affected products2

composer/elgg/elgg:< 3.3.23
composer/elgg/elgg:>= 4.0.0, < 4.0.5

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-3980
https://github.com/elgg/elgg/commit/572d210e2392f1fdf47ff2f38665372a6535c126
https://huntr.dev/bounties/1f43f11e-4bd8-451f-a244-dc9541cdc0ac
https://github.com/Elgg/Elgg/pull/13791
https://github.com/advisories/GHSA-hx6g-q9v2-xh7v