Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Sulu CMS to version 2.6.22 or later if you are using the 2.x branch, or to version 3.0.5 or later if you are using the 3.x branch. These versions contain the patch that fixes the unauthorized access issue.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects the Sulu content management system, specifically versions from 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5. It allows a user who has permission to access the Sulu Admin interface through at least one role to access sub-entities of contacts via the admin API, even if they do not have explicit permission to access contacts themselves.

Essentially, the access control mechanism is flawed, permitting unauthorized access to contact-related data through the admin API.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of contact information because users with limited admin permissions can access contact sub-entities without proper authorization.

Such unauthorized access could result in data leakage, privacy violations, and potential misuse of sensitive contact data.

Useful 0 Not Useful 0