Unauthorized access to screen In silverstripe/framework
Description
Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter
Impact
If a user should not be able to see a record, but that record can be added to a GridField using the GridFieldAddExistingAutocompleter component, the record's title can be accessed by that user.
Base CVSS: 4.3 Reported by: Nick K - LittleMonkey, littlemonkey.co.nz
References
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | 4.13.39, 5.1.11 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3.