TI-2024-18520 Aliases CVE-2024-27915 GHSA-jr83-m233-gg6p

Sulu grants access to pages regardless of role permissions

LOW 38CWE-863Published 2024-03-06 · Updated 2025-04-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Sulu is a PHP content management system. Starting in verson 2.2.0 and prior to version 2.4.17 and 2.5.13, access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. The problem is patched in versions 2.4.17 and 2.5.13. Some workarounds are available. One may apply the patch to `vendor/symfony/security-http/HttpUtils.php` manually or avoid installing `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0045 39th percentileScored 2026-11-07

Fix Fixed sulu (sulu): 2.4.17, 2.5.13sulu/sulu (Packagist): 2.4.17, 2.5.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sulu	sulu	2.2.0 to before 2.4.17; 2.5.0-alpha1 to before 2.5.13	2.4.17, 2.5.13	Patch available	CNA
—	sulu/sulu (Packagist)	2.2.0 to before 2.4.17	2.4.17	Patch available	GHSA-jr83-m233-gg6p
—	sulu/sulu (Packagist)	2.5.0-alpha1 to before 2.5.13	2.5.13	Patch available	GHSA-jr83-m233-gg6p

sulu Vendorsulu Affected 2.2.0 to before 2.4.17; 2.5.0-alpha1 to before 2.5.13 Fixed in 2.4.17, 2.5.13 Patch available CNA
sulu/sulu (Packagist) Vendor— Affected 2.2.0 to before 2.4.17 Fixed in 2.4.17 Patch available GHSA-jr83-m233-gg6p
sulu/sulu (Packagist) Vendor— Affected 2.5.0-alpha1 to before 2.5.13 Fixed in 2.5.13 Patch available GHSA-jr83-m233-gg6p

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sulu:sulu::::::::	2.2.0 to before 2.4.17; 2.5.0 to before 2.5.13	Vulnerable	sulu

cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.4.17; 2.5.0 to before 2.5.13 Vulnerable ·sulu

Remediation

Fix · CNA sulu (sulu) Fixed in 2.4.17, 2.5.13
Fix · GHSA-jr83-m233-gg6p sulu/sulu (Packagist) Fixed in 2.4.17 Advisory →
Fix · GHSA-jr83-m233-gg6p sulu/sulu (Packagist) Fixed in 2.5.13 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-27915
2026-10-03 Alias added: GHSA-jr83-m233-gg6p

References

Patch 1

https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da

Advisory 2

Other 1

https://github.com/sulu/sulu

TI-2021-19642 PHP file inclusion in the Sulu admin panel CVSS 3.1HIGH 8.8
TI-2021-12405 XSS Injection in Media Collection Title was possible CVSS 3.1HIGH 8.4
TI-2021-19641 Privilege escalation in the Sulu Admin panel CVSS 3.1HIGH 7.2
TI-2021-18008 Improper Neutralization HTML tags in sulu/sulu CVSS 3.1MEDIUM 6.2
TI-2024-31897 Reflected XSS Vulnerability in Sulu Media Bundle CVSS 3.1MEDIUM 6.1
TI-2020-11905 Reset Password / Login vulnerability in Sulu CVSS 3.1MEDIUM 5.3

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences