Publish Advisories

GHSA-fqg8-vfv7-8fj8
GHSA-jr83-m233-gg6p
GHSA-r8w9-5wcg-vfj7

advisories/github-reviewed/2024/03/GHSA-jr83-m233-gg6p/GHSA-jr83-m233-gg6p.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jr83-m233-gg6p",
-  "modified": "2024-03-04T20:45:09Z",
+  "modified": "2024-03-06T21:37:49Z",
   "published": "2024-03-04T20:45:08Z",
   "aliases": [
     "CVE-2024-27915"
@@ -9,7 +9,10 @@
   "summary": "Sulu grants access to pages regardless of role permissions",
   "details": "### Impact\n\n_What kind of vulnerability is it? Who is impacted?_\n\nAccess to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue.\n\n### Patches\n\nHas the problem been patched? What versions should users upgrade to?\n\nThe problem is patched with Version `2.4.17` and `2.5.13`.\n\n### Workarounds\n\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nRemove  following lines from `vendor/symfony/security-http/HttpUtils.php`:\n\n```\n-            // Shortcut if request has already been matched before\n-            if ($request->attributes->has('_route')) {\n-                return $path === $request->attributes->get('_route');\n -           }\n```\n\nOr do not install `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.\n\n### References\n\n_Are there any links users can visit to find out more?_\n\nCurrently no references.\n",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
+    }
   ],
   "affected": [
     {
@@ -56,6 +59,10 @@
       "type": "WEB",
       "url": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27915"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da"
@@ -67,11 +74,11 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-863"
     ],
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-04T20:45:08Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-03-06T20:15:47Z"
   }
 }