Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

winter/wn-dusk-plugin

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8PackagistPublished

    Dusk plugin may allow unfettered user authentication in misconfigured installs

    CVE-2024-32003 · GHSA-chcp-g9j5-3xxx

    Affected
    • Packagist winter/wn-dusk-plugin < 2.1.0
    Fixed in
    2.1.0· Vendor fix available
    Issue
    The Dusk plugin provides some special routes as part of its testing framework to allow a browser environment (such as headless Chrome) to act as a user in the Backend or User plugin without having to go through authentication. This route is [[URL]]/dusk/login/[[USER ID]]/[[MANAGER]] - where [[URL]] is the base URL of the site, [[USER ID]] is the ID of the user account and [[MANAGER]] is the authentication manager (either backend for Backend, or user for the User plugin). If a configuration of a site using the Dusk plugin is set up in such a way that the Dusk plugin is available publicly and the test cases in Dusk are run with live data, this route may potentially be used to gain access to any user account in either the Backend or User plugin without authentication. As indicated in the README, this plugin should only be used in development and should NOT be used in a production instance. It is specifically recommended that the plugin be installed as a development dependency only in…

    Recommended action: Upgrade to 2.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →