CVE-2024-29885 MEDIUM

CVE-2024-29885: Reports are still accessible even when `canView()` returns false in silverstripe/reports

Vendor Silverstripe
Product silverstripe-reports
Weakness CWE-200 · Info exposure
Published July 17, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the `canView()` method for that report returns `false`. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

July 17, 2024 CVE published
August 2, 2024 Record updated