CVE-2022-1553 Leaking password protected articles content due to improper access control in publify/publify

High 8.8 Published 16 May 2022 Updated 3 Aug 2024

Attackers can view the contents of password-protected articles on Publify websites due to improper access control checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-1553?

CVE-2022-1553 is a high-severity missing authorization vulnerability in publify/publify, published on 16 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.

Weakness: CWE-863, CWE-284

Which versions are affected by CVE-2022-1553?

3 open source packages ship an affected version, including publify_core and publify. It affects 1 product.

Package	Affected	Fixed in
`publify_core` RubyGems	All versions	`9.2.8`
`publify_core` RubyGems	All versions	`9.2.8`
`publify` Bitnami	All versions	`9.2.8`

Products include Publify Project Publify.

How do I fix CVE-2022-1553?

Upgrade publify_core to 9.2.8 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-1553 being exploited?

There is no known exploitation of CVE-2022-1553 in the wild and no public exploit code.

Sources

Also known as BIT-publify-2022-1553, GHSA-5jm7-g527-m694.