GHSA-g8pg-33v4-9r96
GHSA-g8pg-33v4-9r96 · Thelia authentication bypass vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An authentication bypass was identifed in thelia/thelia project for customer and admin. This vulnerability is present from version 2.0.0-beta1 and is fixed in 2.1.3 and 2.2.0-alpha1.
CVSS 7.5 · High · Fix available
- Published
- Updated
Stack: php
Affected products and versions
thelia/thelia Packagist
- Versions
- 2.0.0
- 2.0.0-RC1
- 2.0.0-beta1
- 2.0.0-beta2
- 2.0.0-beta3
- 2.0.0-beta4
- 2.0.1
- 2.0.10
- 2.0.11
- 2.0.12
- 2.0.2
- 2.0.3
- 2.0.3-beta
- 2.0.3-beta2
- 2.0.4
- 2.0.5
- 2.0.6
- 2.0.7
- 2.0.8
- 2.0.9
- 2.1.0
- 2.1.0-alpha1
- 2.1.0-alpha2
- 2.1.0-beta1
- 2.1.0-beta2
- 2.1.1
- 2.1.2
- Affected ranges
- ECOSYSTEM: ≥ 2.0.0-beta1, < 2.1.3
Update to 2.1.3
Original sources
- https://github.com/github/advisory-database/pull/8012
- https://github.com/thelia/thelia/commit/028cfcf507cd8685772e156ec0c860034d407094
- https://github.com/thelia/thelia/commit/71c1cee66d8f2e515e82478f792879fa63843644
- https://github.com/FriendsOfPHP/security-advisories/blob/master/thelia/thelia/2015-04-13-1.yaml
- https://github.com/thelia/thelia
- https://web.archive.org/web/20160502224630/http://thelia.net/version-2-1-3-with-security-fix
- https://osv.dev/vulnerability/GHSA-g8pg-33v4-9r96