MEDIUM6.5

GHSA-g66v-3v62-g375

RosarioSIS improper access control vulnerability

Quick fix

GHSA-g66v-3v62-g375 — francoisjacquet/rosariosis: upgrade to the fixed version with the command below.

composer require francoisjacquet/rosariosis:^10.9.3

Details

RosarioSIS prior to version 10.9.3 has a vulnerability that allows a user to return to a page containing personally identifiable information (PII) and sensitive information even after logging out of the application by using the browser's back button.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/francoisjacquet/rosariosis

Introduced in: 0Fixed in: 10.9.3

Fixcomposer require francoisjacquet/rosariosis:^10.9.3

References

https://nvd.nist.gov/vuln/detail/CVE-2023-2202[ADVISORY]
https://github.com/francoisjacquet/rosariosis/commit/6433946abfb34324616e833b1c00d0b2450753be[WEB]
https://github.com/francoisjacquet/rosariosis[PACKAGE]
https://github.com/francoisjacquet/rosariosis/compare/v10.9.2...v10.9.3[WEB]
https://huntr.dev/bounties/efe6ef47-d17c-4773-933a-4836c32db85c[WEB]