Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1nOHBnLTMzdjQtOXI5Ns4AA8jp
Thelia authentication bypass vulnerability
An authentication bypass was identifed in thelia/thelia project for customer and admin. This vulnerability is present from version 2.1.0-beta1 and is fixed in 2.1.3 and 2.2.0-alpha1.
Permalink: https://github.com/advisories/GHSA-g8pg-33v4-9r96JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nOHBnLTMzdjQtOXI5Ns4AA8jp
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 6 months ago
Updated: 6 months ago
CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Identifiers: GHSA-g8pg-33v4-9r96
References:
- https://github.com/thelia/thelia/commit/028cfcf507cd8685772e156ec0c860034d407094
- https://github.com/FriendsOfPHP/security-advisories/blob/master/thelia/thelia/2015-04-13-1.yaml
- https://web.archive.org/web/20160502224630/http://thelia.net/version-2-1-3-with-security-fix
- https://github.com/advisories/GHSA-g8pg-33v4-9r96
Blast Radius: 4.5
Affected Packages
packagist:thelia/thelia
Dependent packages: 0Dependent repositories: 4
Downloads: 5,017 total
Affected Version Ranges: >= 2.1.0-beta1, < 2.1.3
Fixed in: 2.1.3
All affected versions: 2.1.0, 2.1.0-beta1, 2.1.0-beta2, 2.1.1, 2.1.2
All unaffected versions: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.1.11, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4