Repository navigation
[GHSA-9p7c-v5x3-rfx8] Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets - #10302
Conversation
|
Hi there @angrybrad! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
🟡 Changes recommended
The valid CVSS v3 severity entry must be restored before approval.
1 open finding
What changed in this PR
Corrects CVSS metadata for the Craft CMS advisory.
Changes:
- Removes the invalid trailing slash from the CVSS v4 vector.
- Updates the advisory modification timestamp.
- Unintentionally removes the CVSS v3 vector.
| File | Description |
|---|---|
GHSA-9p7c-v5x3-rfx8.json |
Updates severity metadata and timestamp. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| { | ||
| "type": "CVSS_V4", | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/" | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" |
There was a problem hiding this comment.
The reason CVSS v3 is applied is that if CVSS v4 is present, only CVSS v4 modifications can be made, and CVSS v3 is automatically deleted. It is not intentionally deleted.
Updates
Comments
Fix CVSS v4 validation.