High severityNVD Advisory· Published Dec 15, 2021· Updated Aug 4, 2024
PHP file inclusion in the Sulu admin panel
CVE-2021-43836
Description
Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sulu/suluPackagist | < 1.6.44 | 1.6.44 |
sulu/suluPackagist | >= 2.0.0, < 2.2.18 | 2.2.18 |
sulu/suluPackagist | >= 2.3.0, < 2.3.8 | 2.3.8 |
sulu/suluPackagist | >= 2.4.0-RC1, < 2.4.0 | 2.4.0 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-vx6j-pjrh-vgjhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-43836ghsaADVISORY
- github.com/sulu/sulu/commit/9c948f9ce350c68b53af8c3910e2cefc7f722b54ghsax_refsource_MISCWEB
- github.com/sulu/sulu/security/advisories/GHSA-vx6j-pjrh-vgjhghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.