GHSA-q3x9-28f7-w8rc

Total.js CMS Unauthorized Access

Source: GitHub Advisory Database (reviewed) High CVE-2019-15953

Packages

Ecosystem	Package	Affected	Fixed in
npm	total4	12.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertical and horizontal privilege escalation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-15953 advisory
https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf web
https://github.com/totaljs/cms package
https://seclists.org/fulldisclosure/2019/Sep/6 web