SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2012-09-17T17:00:00Z

Updated: 2024-09-16T17:19:06.700Z

Reserved: 2011-12-23T00:00:00Z

Link: CVE-2011-4961

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2012-09-17T17:55:02.923

Modified: 2024-11-21T01:33:22.437

Link: CVE-2011-4961

cve-icon Redhat

No data.