CVE-2017-11422: Incorrect Permission Assignment for Critical Resource

May 13, 2022 (updated July 25, 2023)

Statamic framework before 2.6.0 does not correctly check a session’s permissions when the methods from a user’s class are called. Problematic methods include reset password, create new account, create new role, etc.

References

github.com/advisories/GHSA-5m64-9hq5-5pf2
nvd.nist.gov/vuln/detail/CVE-2017-11422

Code Behaviors & Features

Detect and mitigate CVE-2017-11422 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →