Silverstripe Framework has missing permission check of canView in GridFieldPrintButton
Résumé
Silverstripe Framework has missing permission check of canView in GridFieldPrintButton
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Silverstripe Framework is the Model-View-Controller framework that powers the Silverstripe content management system. Prior to version 4.12.15, the GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. Users should upgrade to Silverstripe Framework 4.12.15 or above to address the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com