Authentication Bypass via URL Encoding in Access Governance for WordPress (AAM) URL Access Rules

Skrevet den af i Access Governance for WordPress (aka AAM)

A flaw in how Access Governance for WordPress (AAM) normalises request URLs lets an unauthenticated visitor reach a page that a URL access rule should block. Percent-encoding any character of the path (for example /prot%65cted instead of /protected) made the request miss the rule, while WordPress still resolved and served the protected content. Affects versions up to and including 7.1.0; fixed in 7.1.1.

This vulnerability affects the following application versions:

  • Access Governance for WordPress (aka AAM) 7.0.0
  • Access Governance for WordPress (aka AAM) 7.0.0-alpha.6
  • Access Governance for WordPress (aka AAM) 7.0.0-alpha.7
  • Access Governance for WordPress (aka AAM) 7.0.0-beta.1
  • Access Governance for WordPress (aka AAM) 7.0.0-rc1
  • Access Governance for WordPress (aka AAM) 7.0.0-rc2
  • Access Governance for WordPress (aka AAM) 7.0.0-rc3
  • Access Governance for WordPress (aka AAM) 7.0.1
  • Access Governance for WordPress (aka AAM) 7.0.2
  • Access Governance for WordPress (aka AAM) 7.0.3
  • Access Governance for WordPress (aka AAM) 7.0.4
  • Access Governance for WordPress (aka AAM) 7.0.5
  • Access Governance for WordPress (aka AAM) 7.0.6
  • Access Governance for WordPress (aka AAM) 7.0.7
  • Access Governance for WordPress (aka AAM) 7.0.8
  • Access Governance for WordPress (aka AAM) 7.0.9
  • Access Governance for WordPress (aka AAM) 7.0.10
  • Access Governance for WordPress (aka AAM) 7.0.11
  • Access Governance for WordPress (aka AAM) 7.1.0