CVE-2024-29885

Katalog CVE

CVSS 4.3 · Medium EPSS 0,40%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada silverstripe reports. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the `canView()` method for that report returns `false`. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

17 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/silverstripe/silverstripe-reports/security/advisories/GHSA-89q6-98xx-4ffw advisory vendor
• https://www.silverstripe.org/download/security-releases/cve-2024-29885 advisory vendor
• https://github.com/silverstripe/silverstripe-reports/commit/0351106c18ad4246d983b5f4e082c09c382121f4 patch