CVE-2022-1810: Incorrect Permission Assignment for Critical Resource

May 23, 2022 (updated June 29, 2023)

A low-privileged user can modify and delete admin articles just by changing the value of the article[id] parameter.

References

github.com/publify/publify/commit/c0aba87844d1e47da50c0d99a3465164a4d244ce
huntr.dev/bounties/9b2d7579-032e-42da-b736-4b10a868eacb
nvd.nist.gov/vuln/detail/CVE-2022-1810

Code Behaviors & Features

Detect and mitigate CVE-2022-1810 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →