CVE-2024-29885 Reports are still accessible even when `canView()` returns false in silverstripe/reports

2024-07-1719:35:58

CWE-200

GitHub_M

www.cve.org

cve-2024-29885

silverstripe/reports

backend reports

unauthorized access

version 5.2.3

upgrade

vulnerability

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

Percentile

16.0%

JSON

silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView() method for that report returns false. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CNA Affected

[
  {
    "vendor": "silverstripe",
    "product": "silverstripe-reports",
    "versions": [
      {
        "version": "< 5.2.3",
        "status": "affected"
      }
    ]
  }
]