CVE-2019-15953: Missing Authorization

May 24, 2022 (updated July 17, 2023)

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertical and horizontal privilege escalation.

References

github.com/advisories/GHSA-q3x9-28f7-w8rc
github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf
nvd.nist.gov/vuln/detail/CVE-2019-15953
seclists.org/fulldisclosure/2019/Sep/6

Code Behaviors & Features

Detect and mitigate CVE-2019-15953 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →