CVE-2021-43835
Privilege escalation in the Sulu Admin panel
Description
### Impact Impacted are only users which already have access to the admin UI. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction. ### Patches The versions have been patched in 2.2.18, 2.3.8 and 2.4.0. ### Workarounds Patching the ProfileController of affected sulu versions yourself by overwriting it. ### References _Are there any links users can visit to find out more?_ Currently not. ### For more information If you have any questions or comments about this advisory: * Open an issue in [sulu/sulu repo](https://github.com/sulu/sulu/issues) * Email us at [[email protected]](mailto:[email protected])
How to fix CVE-2021-43835
To remediate CVE-2021-43835, upgrade the affected package to a fixed version below.
- —upgrade to 2.2.18 or later
Is CVE-2021-43835 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 2.0.0, < 2.2.18
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |