CVE-2021-43835

Katalog CVE

CVSS 7.2 · High EPSS 1,2%

Kerentanan Improper Privilege Management pada sulu. Skor CVSS 3.1 7.2 (High) menurut github.com.

Deskripsi (NVD)

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction. The versions have been patched in 2.2.18, 2.3.8 and 2.4.0. For users unable to upgrade the only known workaround is to apply a patch to the ProfileController manually.

Rincian

Terbit di NVD

15 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sulu/sulu/commit/30bf8b5a4f83b6f2171a696011757d095edaa28a patch · advisory pihak ketiga
• https://github.com/sulu/sulu/security/advisories/GHSA-84px-q68r-2fc9 advisory pihak ketiga