Vulnerability · Published May 16, 2022 · Assigned by @huntrdev

CVE-2022-1553Leaking password protected articles content due to improper access control in publify/publify

High 8.8

In plain English

A high-severity improper access control in publify/publify from publify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)8.8High

Exploit odds (30 days)1.2%top 30.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
RubyGems	publify_core	9.2.8	GHSA-5jm7-g527-m694

Affected products (as reported)

Vendor	Product	Versions
publify	publify/publify	unspecified – before 9.2.8

Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://huntr.dev/bounties/b398e4c9-6cdf-4973-ad86-da796cde221f x_refsource_CONFIRM
https://github.com/publify/publify/commit/1a78f16f460847274265a12a9555b3524892d7db x_refsource_MISC