Vulnerability · Published Dec 15, 2021 · Assigned by GitHub_M

CVE-2021-43836PHP file inclusion in the Sulu admin panel

High 8.5

In plain English

A high-severity path traversal in sulu from sulu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)2.0%top 18.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	sulu/sulu	1.6.44	GHSA-vx6j-pjrh-vgjh
Packagist	sulu/sulu	2.2.18	GHSA-vx6j-pjrh-vgjh
Packagist	sulu/sulu	2.3.8	GHSA-vx6j-pjrh-vgjh
Packagist	sulu/sulu	2.4.0	GHSA-vx6j-pjrh-vgjh

Affected products (as reported)

Vendor	Product	Versions
sulu	sulu	< 1.6.44>= 2.0.0, < 2.2.18>= 2.3.0, < 2.3.8

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/sulu/sulu/security/advisories/GHSA-vx6j-pjrh-vgjh x_refsource_CONFIRM
https://github.com/sulu/sulu/commit/9c948f9ce350c68b53af8c3910e2cefc7f722b54 x_refsource_MISC