CVE Vulnerabilities

CVE-2011-4961

Published: Sep 17, 2012 | Modified: Oct 15, 2012
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
6 MEDIUM
AV:N/AC:M/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups.

Affected Software

Name Vendor Start Version End Version
Silverstripe Silverstripe 2.3.4 2.3.4
Silverstripe Silverstripe 2.3.7 2.3.7
Silverstripe Silverstripe 2.3.10 2.3.10
Silverstripe Silverstripe 2.3.3 2.3.3
Silverstripe Silverstripe 2.3.8 2.3.8
Silverstripe Silverstripe 2.3.1 2.3.1
Silverstripe Silverstripe 2.3.5 2.3.5
Silverstripe Silverstripe 2.3.9 2.3.9
Silverstripe Silverstripe 2.3.6 2.3.6
Silverstripe Silverstripe 2.3.11 2.3.11
Silverstripe Silverstripe 2.3.0 2.3.0
Silverstripe Silverstripe 2.3.2 2.3.2

References