CVE-2023-49783 json
No permission checks for editing/deleting records with CSV import form
published 2024-01-23 2 y ago modified 2026-06-17 4 mo ago also GHSA-j3m6-gvm8-mhvw , EUVD-2024-0373
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don't have edit or delete permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import form, provided they have create permissions. The likelihood of a user having create permissions but not having edit or delete permissions is low, but it is possible. Note that this doesn't affect any `ModelAdmin` which has had the import form disabled via the `showImportForm` public property. Versions 1.13.19 and 2.1.8 contain a patch for the issue. Those who have a custom implementation of `BulkLoader` should update their implementations to respect permissions when the return value of `getCheckPermissions()` is true. Those who use any `BulkLoader` in their own project logic, or maintain a module which uses it, should consider passing `true` to `setCheckPermissions()` if the data is provided by users.
Patch / fix
- packagist silverstripe/admin 1.13.19, 2.1.8
- silverstripe admin 1.13.19, 2.1.8
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | silverstripe/admin | >=1.0.0, <1.13.19 >=2.0.0, <2.1.8 |
1.13.19 2.1.8 |
Affected products
- silverstripe silverstripe-admin
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/silverstripe/silverstripe-admin/commit/9693130a0a637cdf512277cf5f07e83250b191db
web
-
github.com
/silverstripe/silverstripe-admin/security/advisories/GHSA-j3m6-gvm8-mhvw
web, vendor-advisory
-
silverstripe.org
/download/security-releases/CVE-2023-49783
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-49783
advisory
-
github.com
/silverstripe-security/security-issues/issues/177
web
-
github.com
/silverstripeltd/product-issues/issues/832
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/silverstripe/admin/CVE-2023-49783.yaml
web
-
github.com
/silverstripe/silverstripe-admin
package
Sources
- CVE List CVE-2023-49783
- GitHub Advisory GHSA-j3m6-gvm8-mhvw
- NVD CVE-2023-49783
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.