GHSA-89q6-98xx-4ffw

Silverstripe Reports are still accessible even when `canView()` returns false

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-29885

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	silverstripe/reports	< 5.2.3	5.2.3

Details

As written in the advisory (Markdown source, shown as plain text).

Reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the `canView()` method for that report returns `false`. ## References - https://www.silverstripe.org/download/security-releases/cve-2024-29885

References

External links from the advisory. They lead to third-party sites.

https://github.com/silverstripe/silverstripe-reports/security/advisories/GHSA-89q6-98xx-4ffw web
https://nvd.nist.gov/vuln/detail/CVE-2024-29885 advisory
https://github.com/silverstripe/silverstripe-reports/commit/0351106c18ad4246d983b5f4e082c09c382121f4 web
https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/reports/CVE-2024-29885.yaml web
https://github.com/silverstripe/silverstripe-reports package
https://www.silverstripe.org/download/security-releases/cve-2024-29885 web