Description
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
lavalite cms
Default version status: unaffected
0 to ≤ 10.1.2affected
pkg:composer/lavalite/cmsReferences
- https://github.com/LavaLite/cms/issues/431 ↗
- https://github.com/LavaLite/framework/blob/a06cba09da27087b2013035c38c536491e4f83ad/src/Litepie/Http/Request/AbstractRequest.php#L62-L70 ↗
- https://github.com/LavaLite/framework/blob/a06cba09da27087b2013035c38c536491e4f83ad/src/Litepie/User/config/user.php#L515 ↗
- https://github.com/LavaLite/cms ↗
- https://www.vulncheck.com/advisories/lavalite-cms-through-10.1.2-authorization-bypass-via-user-update-api ↗