Detections
Analytics
SCA: security update for silverstripe/admin (GHSA-j3m6-gvm8-mhvw)
medium Tenable Self-Hosted Container Security Plugin ID 416097
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on
the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don't have edit or delete
permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import
form, provided they have create permissions. The likelihood of a user having create permissions but not
having edit or delete permissions is low, but it is possible. Note that this doesn't affect any
`ModelAdmin` which has had the import form disabled via the `showImportForm` public property. Versions
1.13.19 and 2.1.8 contain a patch for the issue. Those who have a custom implementation of `BulkLoader`
should update their implementations to respect permissions when the return value of
`getCheckPermissions()` is true. Those who use any `BulkLoader` in their own project logic, or maintain a
module which uses it, should consider passing `true` to `setCheckPermissions()` if the data is provided by
users. (CVE-2023-49783)
See Also
Plugin Details
Severity: Medium
ID: 416097
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N
CVSS Score Source: CVE-2023-49783
CVSS v3
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.8
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 1/23/2024
Vulnerability Publication Date: 1/23/2024
Reference Information
CVE: CVE-2023-49783
cwe: CWE-863