GHSA-g66v-3v62-g375
RosarioSIS improper access control vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | francoisjacquet/rosariosis | < 10.9.3 | 10.9.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
RosarioSIS prior to version 10.9.3 has a vulnerability that allows a user to return to a page containing personally identifiable information (PII) and sensitive information even after logging out of the application by using the browser's back button.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-2202
- https://github.com/francoisjacquet/rosariosis/commit/6433946abfb34324616e833b1c00d0b2450753be
- https://github.com/francoisjacquet/rosariosis
- https://github.com/francoisjacquet/rosariosis/compare/v10.9.2...v10.9.3
- https://huntr.dev/bounties/efe6ef47-d17c-4773-933a-4836c32db85c