CVE-2023-22728
Assigner: GitHub_M
Published: 2023-04-26T13:57:03.733Z
State: PUBLISHED
title: Silverstripe Framework has missing permission check of canView in GridFieldPrintButton
problemTypes: descriptions: cweId: CWE-862
description: CWE-862: Missing Authorization
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
affected: vendor: silverstripe
product: silverstripe-framework
versions: version: < 4.12.5
status: affected
descriptions: value: Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
source: advisory: GHSA-jh3w-6jp2-vqqm
discovery: UNKNOWN