CVE-2021-3980: Information Exposure in elgg
Summary
CVE-2021-3980: Information exposure in elgg. Affects elgg/elgg across 2 version ranges.
< 3.3.23
>= 4.0.0, < 4.0.5
Fixed in 3.3.23 or 4.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
elgg is an open-source social networking platform that allows users to create and manage their own social networks. It provides various features such as user profiles, activity streams, and group management. elgg is vulnerable to an exposure of private personal information to an unauthorized actor.
Vulnerability Detail
The vulnerability in elgg is related to the exposure of private personal information. Specifically, forms in the 'forms/admin' view namespace were not protected by an AdminGatekeeper in case of AJAX requests to 'ajax/form/admin/'. This means that an unauthorized actor could potentially access and view private personal information through these forms. The impact of this vulnerability could be significant, as it could lead to the exposure of sensitive user data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.3.233.3.23composer require elgg/elgg:3.3.23 -
>= 4.0.0, < 4.0.54.0.5composer require elgg/elgg:4.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to update elgg to the latest version.
Conclusion
In conclusion, elgg is vulnerable to an exposure of private personal information due to forms in the 'forms/admin' view namespace not being properly protected. To mitigate this vulnerability, it is crucial to update elgg to the latest version available. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for elgg/elgg →
FAQ
elgg is an open-source social networking platform that allows users to create and manage their own social networks.
The vulnerability could lead to the exposure of private personal information to an unauthorized actor.
To fix this vulnerability, it is recommended to update elgg to the latest version available.
There are no specific workarounds mentioned for this vulnerability. Updating elgg to the latest version is the recommended solution.
You can find more information about this vulnerability in the provided sources and references.
References
Related vulnerabilities
Recent vulnerabilities recorded for elgg/elgg.
