CVE-2011-4961
Severity CVSS v4.0:
Pending analysis
Type:
CWE-264
Permissions, Privileges, and Access Control
Publication date:
17/09/2012
Last modified:
11/04/2025
Description
SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups.
Impact
Base Score 2.0
6.00
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:silverstripe:silverstripe:2.3.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.2:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.3:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.4:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.5:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.6:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.7:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.8:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.9:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.10:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.3.11:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.4.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.4.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:silverstripe:silverstripe:2.4.2:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12
- http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6
- http://www.openwall.com/lists/oss-security/2012/04/30/1
- http://www.openwall.com/lists/oss-security/2012/04/30/3
- https://github.com/silverstripe/sapphire/commit/de1f070
- http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.12
- http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.6
- http://www.openwall.com/lists/oss-security/2012/04/30/1
- http://www.openwall.com/lists/oss-security/2012/04/30/3
- https://github.com/silverstripe/sapphire/commit/de1f070