Kirby up to 4.3.0 authorization

Summaryinfo

A vulnerability labeled as problematic has been found in Kirby up to 4.3.0. This issue affects some unknown processing. Such manipulation leads to authorization. This vulnerability is traded as CVE-2024-41964. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Kirby up to 4.3.0. Affected by this issue is an unknown part. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is integrity, and availability. CVE summarizes:

Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions. Permissions for creating and deleting languages have already existed and could be configured, but were not enforced by Kirby's frontend or backend code. A permission for updating existing languages has not existed before the patched versions. So disabling the languages.* wildcard permission for a role could not have prohibited updates to existing language definitions. The missing permission checks allowed attackers with Panel access to manipulate the language definitions. The problem has been patched in Kirby 3.6.6.6, Kirby 3.7.5.5, Kirby 3.8.4.4, Kirby 3.9.8.2, Kirby 3.10.1.1, and Kirby 4.3.1. Please update to one of these or a later version to fix the vulnerability. There are no known workarounds for this vulnerability.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-41964 since 07/24/2024. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available.

Upgrading to version 3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1 or 4.3.1 eliminates this vulnerability. Applying the patch ab95d172667c3cd529917c2bc94d3c7969706d23 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Kirby

Version

• 3.6.6.0
• 3.6.6.1
• 3.6.6.2
• 3.6.6.3
• 3.6.6.4
• 3.6.6.5
• 3.7.5.0
• 3.7.5.1
• 3.7.5.2
• 3.7.5.3
• 3.7.5.4
• 3.8.4.0
• 3.8.4.1
• 3.8.4.2
• 3.8.4.3
• 3.9.8.0
• 3.9.8.1
• 3.10.0
• 3.10.1.0
• 4.0
• 4.1
• 4.2
• 4.3.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion