Vulnerabilities > CVE-2023-49783 - Unspecified vulnerability in Silverstripe Admin

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

silverstripe

NVD

Published: 2024-01-23

Updated: 2024-11-21

Summary

Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don't have edit or delete permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import form, provided they have create permissions. The likelihood of a user having create permissions but not having edit or delete permissions is low, but it is possible. Note that this doesn't affect any `ModelAdmin` which has had the import form disabled via the `showImportForm` public property. Versions 1.13.19 and 2.1.8 contain a patch for the issue. Those who have a custom implementation of `BulkLoader` should update their implementations to respect permissions when the return value of `getCheckPermissions()` is true. Those who use any `BulkLoader` in their own project logic, or maintain a module which uses it, should consider passing `true` to `setCheckPermissions()` if the data is provided by users.

Vulnerable Configurations

Part	Description	Count
Application	Silverstripe Silverstripe Admin 1.0.0 Silverstripe Admin 1.0.1 Silverstripe Admin 1.0.2 Silverstripe Admin 1.0.3 Silverstripe Admin 1.0.4 Silverstripe Admin 1.0.5 Silverstripe Admin 1.0.6 Silverstripe Admin 1.0.7 Silverstripe Admin 1.1.0 Silverstripe Admin 1.1.1 Silverstripe Admin 1.1.2 Silverstripe Admin 1.1.3 Silverstripe Admin 1.1.4 Silverstripe Admin 1.1.5 Silverstripe Admin 1.2.0 Silverstripe Admin 1.2.1 Silverstripe Admin 1.2.2 Silverstripe Admin 1.2.3 Silverstripe Admin 1.2.4 Silverstripe Admin 1.2.5 Silverstripe Admin 1.2.6 Silverstripe Admin 1.3.0 Silverstripe Admin 1.3.1 Silverstripe Admin 1.3.2 Silverstripe Admin 1.3.3 Silverstripe Admin 1.3.4 Silverstripe Admin 1.3.5 Silverstripe Admin 1.4.0 Silverstripe Admin 1.4.1 Silverstripe Admin 1.4.2 Silverstripe Admin 1.4.3 Silverstripe Admin 1.4.4 Silverstripe Admin 1.4.5 Silverstripe Admin 1.5.0 Silverstripe Admin 1.5.1 Silverstripe Admin 1.5.2 Silverstripe Admin 1.6.0 Silverstripe Admin 1.6.1 Silverstripe Admin 1.6.2 Silverstripe Admin 1.6.3 Silverstripe Admin 1.6.4 Silverstripe Admin 1.7.0 Silverstripe Admin 1.7.1 Silverstripe Admin 1.7.2 Silverstripe Admin 1.7.3 Silverstripe Admin 1.7.4 Silverstripe Admin 1.8.0 Silverstripe Admin 1.8.1 Silverstripe Admin 1.9.0 Silverstripe Admin 1.10.0 Silverstripe Admin 1.10.1 Silverstripe Admin 1.10.2 Silverstripe Admin 1.10.3 Silverstripe Admin 1.10.4 Silverstripe Admin 1.11.0 Silverstripe Admin 1.11.1 Silverstripe Admin 1.11.2 Silverstripe Admin 1.11.3 Silverstripe Admin 1.12.0 Silverstripe Admin 1.12.1 Silverstripe Admin 1.12.2 Silverstripe Admin 1.12.3 Silverstripe Admin 1.12.4 Silverstripe Admin 1.12.5 Silverstripe Admin 1.12.6 Silverstripe Admin 1.12.7 Silverstripe Admin 1.13.0 Silverstripe Admin 1.13.1 Silverstripe Admin 1.13.2 Silverstripe Admin 1.13.3 Silverstripe Admin 1.13.4 Silverstripe Admin 1.13.5 Silverstripe Admin 1.13.6 Silverstripe Admin 1.13.7 Silverstripe Admin 1.13.8 Silverstripe Admin 1.13.9 Silverstripe Admin 1.13.10 Silverstripe Admin 1.13.11 Silverstripe Admin 1.13.12 Silverstripe Admin 1.13.13 Silverstripe Admin 1.13.14 Silverstripe Admin 1.13.15 Silverstripe Admin 1.13.16 Silverstripe Admin 1.13.17 Silverstripe Admin 1.13.18 Silverstripe Admin 2.0.0 Silverstripe Admin 2.0.1 Silverstripe Admin 2.0.2 Silverstripe Admin 2.0.3 Silverstripe Admin 2.0.4 Silverstripe Admin 2.0.5 Silverstripe Admin 2.0.6 Silverstripe Admin 2.0.7 Silverstripe Admin 2.0.8 Silverstripe Admin 2.0.9 Silverstripe Admin 2.0.10 Silverstripe Admin 2.0.11 Silverstripe Admin 2.0.12 Silverstripe Admin 2.0.13 Silverstripe Admin 2.1.0 Silverstripe Admin 2.1.1 Silverstripe Admin 2.1.2 Silverstripe Admin 2.1.3 Silverstripe Admin 2.1.4 Silverstripe Admin 2.1.5 Silverstripe Admin 2.1.6 Silverstripe Admin 2.1.7	149

Summary

Vulnerable Configurations

References