CVE-2023-2665: RosarioSIS Stores Sensitive Data in a Mechanism without Access Control
Summary
CVE-2023-2665: RosarioSIS Stores Sensitive Data in a Mechanism without Access Control. Affects francoisjacquet/rosariosis versions < 11.0. Fixed in 11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RosarioSIS is an open-source student information system designed for educational institutions. It provides various modules for managing student data, including the 'salaries' module. This module allows administrators to store and manage salary information for staff members. However, prior to version 11.0, RosarioSIS had a vulnerability that allowed anyone, regardless of authentication status, to download and view file attachments under the 'salaries' module. The file names followed a predictable pattern, making it relatively easy for attackers to enumerate and access sensitive salary information.
Vulnerability Detail
The vulnerability in RosarioSIS version prior to 11.0 allowed unauthorized access to file attachments in the 'salaries' module. Attackers could exploit this vulnerability to gain access to sensitive salary information of staff members. The file names contained a date in the 'YYYY-MM-DD' format and a random six-string digit, which made it easier for automated tools to guess the file names. The patch in version 11.0 added microseconds to the filenames to make them harder to guess, mitigating the vulnerability.
How To Fix
Minimum fixed version
11.0
This is the first release that contains the fix.
composer require francoisjacquet/rosariosis:11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to upgrade to the patched version as soon as possible.
Conclusion
RosarioSIS prior to version 11.0 had a vulnerability that allowed unauthorized access to file attachments in the 'salaries' module, potentially exposing sensitive salary information. The patch in version 11.0 adds additional randomness to the filenames, making them harder to guess and mitigating the vulnerability. Users of RosarioSIS are advised to upgrade to version 11.0 or later to protect against this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for francoisjacquet/rosariosis →
FAQ
RosarioSIS is an open-source student information system used by educational institutions to manage student data.
The 'salaries' module in RosarioSIS allows administrators to store and manage salary information for staff members.
The vulnerability in RosarioSIS allowed anyone, regardless of authentication status, to download and view file attachments in the 'salaries' module, potentially exposing sensitive salary information.
The vulnerability can be fixed by upgrading to RosarioSIS version 11.0 or later, which adds microseconds to the filenames of file attachments in the 'salaries' module to make them harder to guess.
There is no specific workaround mentioned for this vulnerability. Upgrading to the patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for francoisjacquet/rosariosis.
