CVE-2024-27915

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27915", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-02-28T15:14:14.213Z", "datePublished": "2024-03-06T19:33:11.798Z", "dateUpdated": "2025-04-16T15:54:40.497Z"}, "containers": {"cna": {"title": "Sulu grants access to pages regardless of role permissions", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p"}, {"name": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da", "tags": ["x_refsource_MISC"], "url": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da"}], "affected": [{"vendor": "sulu", "product": "sulu", "versions": [{"version": ">= 2.2.0, < 2.4.17", "status": "affected"}, {"version": ">= 2.5.0-alpha1, < 2.5.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-06T19:33:11.798Z"}, "descriptions": [{"lang": "en", "value": "Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`."}], "source": {"advisory": "GHSA-jr83-m233-gg6p", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "sulu", "product": "sulu", "cpes": ["cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.2.0", "status": "affected", "lessThan": "2.4.17", "versionType": "custom"}, {"version": "2.5.0-alpha1", "status": "affected", "lessThan": "2.5.13", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-07T16:35:44.612681Z", "id": "CVE-2024-27915", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T15:54:40.497Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:41:55.581Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p"}, {"name": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p", "name": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da", "name": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:41:55.581Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27915", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-07T16:35:44.612681Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:*"], "vendor": "sulu", "product": "sulu", "versions": [{"status": "affected", "version": "2.2.0", "lessThan": "2.4.17", "versionType": "custom"}, {"status": "affected", "version": "2.5.0-alpha1", "lessThan": "2.5.13", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T14:10:15.003Z"}}], "cna": {"title": "Sulu grants access to pages regardless of role permissions", "source": {"advisory": "GHSA-jr83-m233-gg6p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "sulu", "product": "sulu", "versions": [{"status": "affected", "version": ">= 2.2.0, < 2.4.17"}, {"status": "affected", "version": ">= 2.5.0-alpha1, < 2.5.13"}]}], "references": [{"url": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p", "name": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da", "name": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-06T19:33:11.798Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27915", "state": "PUBLISHED", "dateUpdated": "2025-04-16T15:54:40.497Z", "dateReserved": "2024-02-28T15:14:14.213Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-03-06T19:33:11.798Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "sulu", "vendor": "sulu", "versions": [{"status": "affected", "version": ">= 2.2.0, < 2.4.17"}, {"status": "affected", "version": ">= 2.5.0-alpha1, < 2.5.13"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "sulu", "vendor": "sulu", "versions": [{"lessThan": "2.4.17", "status": "affected", "version": "2.2.0", "versionType": "custom"}, {"lessThan": "2.5.13", "status": "affected", "version": "2.5.0-alpha1", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:*", "matchCriteriaId": "552E4458-5771-4AF7-B8CB-D742280EF855", "versionEndExcluding": "2.4.17", "versionStartIncluding": "2.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A934DEB-DB97-4461-8542-588A268F9060", "versionEndExcluding": "2.5.13", "versionStartIncluding": "2.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`."}, {"lang": "es", "value": "Sulu es un sistema de gesti\u00f3n de contenidos PHP. A partir de la versi\u00f3n 2.2.0 y anteriores a la versi\u00f3n 2.4.17 y 2.5.13, el acceso a las p\u00e1ginas se otorga independientemente de los permisos de funci\u00f3n para los espacios web que tienen un sistema de seguridad configurado y la verificaci\u00f3n de permisos habilitada. Los espacios web sin \u00e9l no tienen este problema. El problema est\u00e1 solucionado en las versiones 2.4.17 y 2.5.13. Algunas soluciones est\u00e1n disponibles. Se puede aplicar el parche a `vendor/symfony/security-http/HttpUtils.php` manualmente o evitar instalar versiones de `symfony/security-http` mayores que `v5.4.30` o `v6.3.6`."}], "id": "CVE-2024-27915", "lastModified": "2026-06-17T07:20:35.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-27915", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-03-07T16:35:44.612681Z", "version": "2.0.3"}}]}, "published": "2024-03-06T20:15:47.930", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}