{
"id": "GHSA-hx6g-q9v2-xh7v",
"aliases": [
"CVE-2021-3980"
],
"details": "elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Forms in the view namespace 'forms/admin' were not protected by an AdminGatekeeper in case of AJAX requests to 'ajax/form/admin/'.",
"summary": "Information exposure in elgg",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.23"
}
]
}
],
"package": {
"name": "elgg/elgg",
"ecosystem": "Packagist"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.5"
}
]
}
],
"package": {
"name": "elgg/elgg",
"ecosystem": "Packagist"
}
}
],
"modified": "2021-12-06T22:01:08Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"published": "2021-12-16T15:30:48Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3980",
"type": "ADVISORY"
},
{
"url": "https://github.com/Elgg/Elgg/pull/13791",
"type": "WEB"
},
{
"url": "https://github.com/elgg/elgg/commit/572d210e2392f1fdf47ff2f38665372a6535c126",
"type": "WEB"
},
{
"url": "https://github.com/Elgg/Elgg",
"type": "PACKAGE"
},
{
"url": "https://huntr.dev/bounties/1f43f11e-4bd8-451f-a244-dc9541cdc0ac",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-359"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2021-12-03T15:15:00Z",
"github_reviewed_at": "2021-12-06T22:01:08Z"
}
}