Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to (including their own). While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending arbitrary HTTP request to craft a request to the /admin/users/{userid}/memberships/{membershipid} endpoint containing an additional membership[entityid] parameter. This parameter is honored when the membership is updated, allowing an attacker to update the membership object associated with their own account (with manager role) to be associated with a different attacker-chosen account instead. Since accountids are enumerable, an attacker can compromise all accounts present on the platform. Mitigation Upgrade to version 15.7.1 or 14.5.2 of the pageflow gem. For more information If you have any questions or comments about this advisory email us at info(at)codevise.de Credits Positive Security
Recommended action: Upgrade to 15.7.1 or 14.5.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to. Pageflow uses the ActiveAdmin Ruby library to provide some management features to its users. ActiveAdmin relies on the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. The startswith, endswith or contains search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force. [1] https://activerecord-hackery.github.io/ransack/going-further/associations/ [2] https://activerecord-hackery.github.io/ransack/getting-started/search-matches/ Mitigation Upgrade to version 15.7.1 or 14.5.2 of the pageflow gem. For more information If you have any questions or comments about this advisory email us at info(at)codevise.de…
Recommended action: Upgrade to 15.7.1 or 14.5.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.