Privilege escalation in the Sulu Admin panel
Package
Affected versions
>= 2.0.0, <= 2.2.17
>= 2.3.0, <= 2.3.7
= 2.4.0-RC1
Patched versions
2.2.18
2.3.8
2.4.0
Description
Published by the National Vulnerability Database
Dec 15, 2021
Reviewed
Dec 15, 2021
Published to the GitHub Advisory Database
Dec 15, 2021
Last updated
Feb 1, 2023
Impact
Impacted are only users which already have access to the admin UI. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction.
Patches
The versions have been patched in 2.2.18, 2.3.8 and 2.4.0.
Workarounds
Patching the ProfileController of affected sulu versions yourself by overwriting it.
References
Are there any links users can visit to find out more?
Currently not.
For more information
If you have any questions or comments about this advisory:
References