PT-2012-2022
CVE-2011-4961
·
Publicado
2012-09-17
·
Atualizado
2012-10-15
Descrição por
CVSS 2.0
6.0
MédiaMétricasAV:N/AC:M/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
SilverStripe versions 2.3.x through 2.3.11
SilverStripe versions 2.4.x through 2.4.5
Description
The issue allows remote authenticated users with the EDIT PERMISSIONS permission to gain administrator privileges. This is achieved via a TreeMultiselectField that includes admin groups when adding a user to the selected groups.
Recommendations
For SilverStripe versions 2.3.x through 2.3.11, update to version 2.3.12 or later.
For SilverStripe versions 2.4.x through 2.4.5, update to version 2.4.6 or later.
Explorabilidade
Correção
Pesquisadores
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾