CVE-2017-16754: Bolt Improper Access Control
Summary
CVE-2017-16754: Bolt Improper Access Control. Affects bolt/bolt versions < 3.3.6. Fixed in 3.3.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bolt is an open-source content management system (CMS) written in PHP. It provides a flexible and easy-to-use platform for building and managing websites. The vulnerability in Bolt before version 3.3.6 allows improper access control to _profiler routes, specifically in the EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php files.
Vulnerability Detail
The vulnerability in Bolt allows unauthorized access to certain routes that should be restricted. This can potentially lead to unauthorized users gaining access to sensitive information or performing actions that they should not be able to. The issue has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.3.6
This is the first release that contains the fix.
composer require bolt/bolt:3.3.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the latest version of Bolt.
Conclusion
In conclusion, the vulnerability in Bolt before version 3.3.6 allows improper access control to certain routes, potentially leading to unauthorized access and actions. To mitigate this vulnerability, it is crucial to update to Bolt version 3.3.6 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for bolt/bolt →
FAQ
Bolt is an open-source content management system (CMS) written in PHP. It provides a flexible and easy-to-use platform for building and managing websites.
The vulnerability allows unauthorized access to certain routes in Bolt, potentially leading to unauthorized users gaining access to sensitive information or performing unauthorized actions.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
To fix this vulnerability, it is recommended to update to Bolt version 3.3.6 or later.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the latest version of Bolt.
Related vulnerabilities
Recent vulnerabilities recorded for bolt/bolt.
