{"id":"GHSA-m58q-qq5h-mgqq","aliases":[],"status":"published","title":"Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository","description":"### Impact\nThis vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.\n\n### Patches\nUpgrade immediately to the [latest release](https://github.com/Islandora/islandora/releases/tag/2.4.1) of Islandora.\n\n### Workarounds\nIn lieu of an upgrade the [following module](https://github.com/Islandora/islandora_ghsa_route_fix) can be leveraged that will resolve the issue until such a time an upgrade can take place.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Islandora](https://github.com/Islandora/islandora)\n* Contact community@islandora.ca.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-07-21T22:36:20Z","modified":"2024-11-28T05:44:01Z","fixes":[{"ecosystem":"Packagist","package":"islandora/islandora","fixed_in":["2.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"islandora/islandora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"islandora/islandora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"2.4.1"}]}],"versions":["2.0.0","2.0.1","2.1.0","2.1.1","2.2.0","2.2.1","2.3.0","2.4.0"]}],"references":[{"url":"https://github.com/Islandora/islandora/security/advisories/GHSA-m58q-qq5h-mgqq","tags":["web"]},{"url":"https://github.com/Islandora/islandora/commit/573d6878edf057987f1e41e5068de0074573e4c7","tags":["web"]},{"url":"https://github.com/Islandora/islandora/releases/tag/2.4.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m58q-qq5h-mgqq"},{"url":"https://github.com/Islandora-CLAW/islandora","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-m58q-qq5h-mgqq","title":"Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository","description":"### Impact\nThis vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.\n\n### Patches\nUpgrade immediately to the [latest release](https://github.com/Islandora/islandora/releases/tag/2.4.1) of Islandora.\n\n### Workarounds\nIn lieu of an upgrade the [following module](https://github.com/Islandora/islandora_ghsa_route_fix) can be leveraged that will resolve the issue until such a time an upgrade can take place.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Islandora](https://github.com/Islandora/islandora)\n* Contact community@islandora.ca.\n","status":"published","published":"2022-07-21T22:36:20Z","modified":"2023-01-12T05:02:56Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:36:14.033357Z"}],"osv":[{"id":"GHSA-m58q-qq5h-mgqq","title":"Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository","description":"### Impact\nThis vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.\n\n### Patches\nUpgrade immediately to the [latest release](https://github.com/Islandora/islandora/releases/tag/2.4.1) of Islandora.\n\n### Workarounds\nIn lieu of an upgrade the [following module](https://github.com/Islandora/islandora_ghsa_route_fix) can be leveraged that will resolve the issue until such a time an upgrade can take place.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Islandora](https://github.com/Islandora/islandora)\n* Contact community@islandora.ca.\n","status":"published","published":"2022-07-21T22:36:20Z","modified":"2024-11-28T05:44:01.860547Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:51.463834Z"}]}}