Information disclosure in Silverstripe Reports
CVE-2024-29885
silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the `canView()` method for that report returns `false`. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability class: Information Disclosure
EPSS: 0.004 (33.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Silverstripe Reports
- Silverstripe Silverstripe-reports — versions < 5.2.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-29885?
- CVE-2024-29885 is a medium-severity vulnerability in Silverstripe Reports, classified under Information Disclosure. CVSS score: 4.3/10. Published 2024-07-17.
- How severe is CVE-2024-29885?
- Medium severity. CVSS v3 base score is 4.3 out of 10.