CVE-2024-27915CWE-863

Sulu grants access to pages regardless of role permissions

Medium · published March 6, 2024

CVSS v3.1
6.8
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2024-03-06T19:33Z
EPSS history
Timeline
  • 06 MAR 19:33Z
    Sulu grants access to pages regardless of role permissions
    cvelistv5