GHSA-x3rq-r3cm-5vc4 BIT-publify-2022-0524 CVE-2022-0524
Publify Business Logic Errors
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.57%
- Chance of exploitation in the next 30 days. Higher than 75.32% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-841 Improper Enforcement of Behavioral Workflow
- Fix
9.2.7- Upgrade publify_core to this version or later
Description
Publify (formerly known as Typo) prior to version 9.2.7 is vulnerable to business logic errors.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| publify_core | < 9.2.7 |
9.2.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
publify_core RubyGems → 9.2.7
- bundler
bundle update publify_core # Gemfile: gem "publify_core", ">= 9.2.7"
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-841: Improper Enforcement of Behavioral Workflow
The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8fm5-gg2f-f66q Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction | Medium | Also affects publify_core |
| GHSA-g7gf-2rqw-5rwx Publify contains Weak Password Requirements | Medium | Also affects publify_core |
| GHSA-rc42-jghf-vr8f Integer overflow in publify_core | Critical | Also affects publify_core |
| GHSA-q3rm-f527-ghxj Publify Improper Input Validation vulnerability | Critical | Also affects publify_core |
| GHSA-79wq-g4v9-gfj4 Publify Core does not strip metadata from images | Medium | Also affects publify_core |
| GHSA-wmh9-x28j-c6gr Cross site scripting in publify | Medium | Also affects publify_core |
| GHSA-3h7v-wqw7-ff28 Cross site scripting in publify | Medium | Also affects publify_core |
| GHSA-c273-c6vg-4pv5 Publify has Improper Access Controls | Medium | Also affects publify_core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor