easyadmin-extension-bundle action case insensitivity · GHSA-32rx-xvvr-4xv9 · GitHub Advisory Database · GitHub

easyadmin-extension-bundle action case insensitivity

High severity GitHub Reviewed Published May 15, 2024 to the GitHub Advisory Database • Updated May 15, 2024

Package

alterphp/easyadmin-extension-bundle (Composer)

Affected versions

>= 1.3.0, < 1.3.1

>= 1.2.0, < 1.2.11

Patched versions

1.3.1

1.2.11

Description

In alterphp/easyadmin-extension-bundle, role based access rules do not handle action name case sensitivity which may lead to unauthorized access.

References

Published to the GitHub Advisory Database May 15, 2024

Reviewed May 15, 2024

Last updated May 15, 2024

Severity

High

7.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N