CVE-2011-4961

Published: Sep 17, 2012Modified: Apr 29, 2026

6.0

Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability: 6.8 / Impact: 6.4

Source: NVD

Description

SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain administrator privileges via a TreeMultiselectField that includes admin groups when adding a user to the selected groups.

Affected (18)

Products: Silverstripe: Silverstripe

Silverstripe

1 product

Silverstripe

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Silverstripe Silverstripe	Version 2.3.0
Silverstripe Silverstripe	Version 2.3.10
Silverstripe Silverstripe	Version 2.3.11
Silverstripe Silverstripe	Version 2.3.1
Silverstripe Silverstripe	Version 2.3.2
Silverstripe Silverstripe	Version 2.3.3
Silverstripe Silverstripe	Version 2.3.4
Silverstripe Silverstripe	Version 2.3.5
Silverstripe Silverstripe	Version 2.3.6
Silverstripe Silverstripe	Version 2.3.7
Silverstripe Silverstripe	Version 2.3.8
Silverstripe Silverstripe	Version 2.3.9

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Silverstripe Silverstripe	Version 2.4.0
Silverstripe Silverstripe	Version 2.4.1
Silverstripe Silverstripe	Version 2.4.2
Silverstripe Silverstripe	Version 2.4.3
Silverstripe Silverstripe	Version 2.4.4
Silverstripe Silverstripe	Version 2.4.5