GHSA-CF2J-VF36-C6W8高危已审查

Communities and collections administrators can escalate their privilege up to system administrator

OSV 1.4.0 · github-reviewed · 修改于 2021-10-30 01:26

发布时间

2021-11-02 03:18

GitHub 审查时间

2021-10-30 01:26

NVD 发布时间

2021-10-30 02:15

源文件

advisories/github-reviewed/2021/11/GHSA-cf2j-vf36-c6w8/GHSA-cf2j-vf36-c6w8.json

公告说明

Impact

Any community or collection administrator can escalate their permission up to become system administrator.

This vulnerability only existed in 7.0 and does not impact 6.x or below.

Patches

Fix is included in 7.1. Please upgrade to 7.1 at your earliest convenience.

Workarounds

In 7.0, temporarily disable the ability for community or collection administrators to manage permissions or workflows settings, i.e. set the following properties in your local.cfg / dspace.cfg file

core.authorization.collection-admin.policies = false
core.authorization.community-admin.policies = false
core.authorization.community-admin.collection.workflows = false

Once upgraded to 7.1, these settings can be safely reverted to the default values of true.

References

Discovered during investigation of https://github.com/DSpace/DSpace/issues/7928

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

受影响的软件包

标识信息

别名 / CVE

CVE-2021-41189

CWE

CWE-863

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-cf2j-vf36-c6w8",
  "aliases": [
    "CVE-2021-41189"
  ],
  "details": "### Impact\nAny community or collection administrator can escalate their permission up to become system administrator.\n\nThis vulnerability only existed in 7.0 and does not impact 6.x or below.\n\n### Patches\nFix is included in [7.1](https://github.com/DSpace/DSpace/releases/tag/dspace-7.1). Please upgrade to 7.1 at your earliest convenience.\n\n### Workarounds\nIn 7.0, temporarily disable the ability for community or collection administrators to manage permissions or workflows settings, i.e. set the following properties in your local.cfg / dspace.cfg file\n```\ncore.authorization.collection-admin.policies = false\ncore.authorization.community-admin.policies = false\ncore.authorization.community-admin.collection.workflows = false\n```\nOnce upgraded to 7.1, these settings can be safely reverted to the default values of `true`.\n\n### References\nDiscovered during investigation of https://github.com/DSpace/DSpace/issues/7928\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [email protected]\n",
  "summary": "Communities and collections administrators can escalate their privilege up to system administrator",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "7.0"
            },
            {
              "fixed": "7.1"
            }
          ]
        }
      ],
      "package": {
        "name": "org.dspace:dspace-api",
        "ecosystem": "Maven"
      }
    }
  ],
  "modified": "2021-10-29T17:26:35Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "published": "2021-11-01T19:18:16Z",
  "references": [
    {
      "url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-cf2j-vf36-c6w8",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41189",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/DSpace/DSpace/issues/7928",
      "type": "WEB"
    },
    {
      "url": "https://github.com/DSpace/DSpace/commit/277b499a5cd3a4f5eb2370513a1b7e4ec2a6e041",
      "type": "WEB"
    },
    {
      "url": "https://github.com/DSpace/DSpace/commit/c3bea16ab911606e15ae96c97a1575e1ffb14f8a",
      "type": "WEB"
    },
    {
      "url": "https://github.com/DSpace/DSpace",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2021-10-29T18:15:00Z",
    "github_reviewed_at": "2021-10-29T17:26:35Z"
  }
}