CVE-2021-43835
Privilege escalation in the Sulu Admin panel
描述
### Impact Impacted are only users which already have access to the admin UI. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction. ### Patches The versions have been patched in 2.2.18, 2.3.8 and 2.4.0. ### Workarounds Patching the ProfileController of affected sulu versions yourself by overwriting it. ### References _Are there any links users can visit to find out more?_ Currently not. ### For more information If you have any questions or comments about this advisory: * Open an issue in [sulu/sulu repo](https://github.com/sulu/sulu/issues) * Email us at [security@sulu.io](mailto:security@sulu.io)
如何修補 CVE-2021-43835
要修補 CVE-2021-43835,請將受影響套件升級到下列已修補版本。
- —升級至 2.2.18 或更新版本
CVE-2021-43835 正在被利用嗎?
低 — EPSS 為 1.1%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 2.0.0, < 2.2.18
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |