{"id":"GHSA-m58q-qq5h-mgqq","aliases":[],"title":"Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository","description":"### Impact\nThis vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.\n\n### Patches\nUpgrade immediately to the [latest release](https://github.com/Islandora/islandora/releases/tag/2.4.1) of Islandora.\n\n### Workarounds\nIn lieu of an upgrade the [following module](https://github.com/Islandora/islandora_ghsa_route_fix) can be leveraged that will resolve the issue until such a time an upgrade can take place.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Islandora](https://github.com/Islandora/islandora)\n* Contact community@islandora.ca.\n","severity":"critical","score":10,"published":"2022-07-21T22:36:20.000Z","modified":"2024-11-28T05:44:01.860Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"islandora/islandora","ranges":[{"events":[{"introduced":"2.0"},{"fixed":"2.4.1"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.1","2.1.0","2.1.1","2.2.0","2.2.1","2.3.0","2.4.0"],"fixed":["2.4.1"]}],"references":["https://github.com/Islandora/islandora/security/advisories/GHSA-m58q-qq5h-mgqq","https://github.com/Islandora/islandora/commit/573d6878edf057987f1e41e5068de0074573e4c7","https://github.com/Islandora-CLAW/islandora","https://github.com/Islandora/islandora/releases/tag/2.4.1"],"sources":[{"name":"OSV","id":"GHSA-m58q-qq5h-mgqq","modified":"2024-11-28T05:44:01.860547Z","url":"https://osv.dev/vulnerability/GHSA-m58q-qq5h-mgqq"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10}]}