{"answers":{"affected":"4 open source packages ship an affected version, including silverstripe/admin. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-49783 in the wild and no public exploit code.","fix":"Upgrade silverstripe/admin to a fixed version for your release line: 1.13.19 or 2.1.8.","what":"CVE-2023-49783 is a medium-severity missing authorization vulnerability in silverstripe-admin, published on 23 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-49783 and fix it if it is affected.\n\nWhat it is: CVE-2023-49783 is a medium-severity missing authorization vulnerability in silverstripe-admin, published on 23 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-49783 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- silverstripe/admin (Packagist): affected from 1.0.0; fixed in 1.13.19\n- silverstripe/admin (Packagist): affected from 1.0.0; fixed in 1.13.19\n- silverstripe/admin (Packagist): affected from 2.0.0; fixed in 2.1.8\n- silverstripe/admin (Packagist): affected from 2.0.0; fixed in 2.1.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-49783/ (Markdown: https://insights.sbomify.com/CVE-2023-49783/index.md)","id":"CVE-2023-49783","markdown":"https://insights.sbomify.com/CVE-2023-49783/index.md","name":"CVE-2023-49783","record":{"aliases":["GHSA-j3m6-gvm8-mhvw"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Silverstripe Admin","requires_auth":"low_privilege","summary":"Users with create permissions can edit or delete records via CSV import despite lacking edit or delete permissions in Silverstripe Admin.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"admin","vendor":"silverstripe"}],"cvss":{"score":4.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don't have edit or delete permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import form, provided they have create permissions. The likelihood of a user having create permissions but not having edit or delete permissions is low, but it is possible. Note that this doesn't affect any `ModelAdmin` which has had the import form disabled via the `showImportForm` public property. Versions 1.13.19 and 2.1.8 contain a patch for the issue. Those who have a custom implementation of `BulkLoader` should update their implementations to respect permissions when the return value of `getCheckPermissions()` is true. Those who use any `BulkLoader` in their own project logic, or maintain a module which uses it, should consider passing `true` to `setCheckPermissions()` if the data is provided by users.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"No permission checks for editing/deleting records with CSV import form","id":"CVE-2023-49783","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"missing_authorization","year":"2023"},"n_packages":4,"n_references":2,"next":{"headline":"NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting","id":"CVE-2023-49785"},"packages":[{"ecosystem":"Packagist","fixed":["1.13.19"],"introduced":["1.0.0"],"last_affected":[],"package":"silverstripe/admin","purl":null,"source":"GHSA-j3m6-gvm8-mhvw"},{"ecosystem":"Packagist","fixed":["1.13.19"],"introduced":["1.0.0"],"last_affected":[],"package":"silverstripe/admin","purl":"pkg:composer/silverstripe/admin","source":"GHSA-j3m6-gvm8-mhvw"},{"ecosystem":"Packagist","fixed":["2.1.8"],"introduced":["2.0.0"],"last_affected":[],"package":"silverstripe/admin","purl":null,"source":"GHSA-j3m6-gvm8-mhvw"},{"ecosystem":"Packagist","fixed":["2.1.8"],"introduced":["2.0.0"],"last_affected":[],"package":"silverstripe/admin","purl":"pkg:composer/silverstripe/admin","source":"GHSA-j3m6-gvm8-mhvw"}],"prev":{"headline":"Cross-Site-Scripting vulnerability in error message passing in richdocumentscode","id":"CVE-2023-49782"},"products":["silverstripe-admin"],"published":"2024-01-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-06-17","vendors":["silverstripe"]},"summary":"Users with create permissions can edit or delete records via CSV import despite lacking edit or delete permissions in Silverstripe Admin.","url":"https://insights.sbomify.com/CVE-2023-49783/"}