Vulnerability · Published Mar 6, 2024 · Assigned by GitHub_M

CVE-2024-27915Sulu grants access to pages regardless of role permissions

Medium 6.8

In plain English

A medium-severity incorrect authorization in sulu from sulu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 60.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	sulu/sulu	2.4.17	GHSA-jr83-m233-gg6p
Packagist	sulu/sulu	2.5.13	GHSA-jr83-m233-gg6p

Affected products (as reported)

Vendor	Product	Versions
sulu	sulu	>= 2.2.0, < 2.4.17>= 2.5.0-alpha1, < 2.5.13

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p x_refsource_CONFIRM
https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da x_refsource_MISC