CVE-2022-29858

MEDIUM

Silverstripe Assets < 1.10.1 - Authentication Bypass

Title source: rule
STIX 2.1

Description

Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content.

References (6)

Core 6
Core References
Not Applicable, Vendor Advisory x_refsource_misc
https://www.silverstripe.org/download/security-releases/
Release Notes, Vendor Advisory x_refsource_misc
https://www.silverstripe.org/blog/tag/release
Release Notes, Vendor Advisory x_refsource_misc
https://forum.silverstripe.org/c/releases
Release Notes, Vendor Advisory x_refsource_misc
https://www.silverstripe.org/download/security-releases/cve-2022-29858
Exploit, Third Party Advisory x_refsource_misc
https://huntr.dev/bounties/90e17d95-9f2f-44eb-9f26-49fa13a41d5a/

Scores

CVSS v3 4.3
EPSS 0.0033
EPSS Percentile 56.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-287
Status published
Products (2)
silverstripe/assets < 1.10.1
silverstripe/assets 1.0.0 - 1.10.1Packagist
Published Jun 28, 2022
Tracked Since Feb 18, 2026