GHSA-hx6g-q9v2-xh7v

Information exposure in elgg

Source: GitHub Advisory Database (reviewed) High CVE-2021-3980

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	elgg/elgg	< 3.3.23	3.3.23
Packagist	elgg/elgg	>= 4.0.0, < 4.0.5	4.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Forms in the view namespace 'forms/admin' were not protected by an AdminGatekeeper in case of AJAX requests to 'ajax/form/admin/'.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3980 advisory
https://github.com/Elgg/Elgg/pull/13791 web
https://github.com/elgg/elgg/commit/572d210e2392f1fdf47ff2f38665372a6535c126 web
https://github.com/Elgg/Elgg package
https://huntr.dev/bounties/1f43f11e-4bd8-451f-a244-dc9541cdc0ac web