Описание
OneUptime Unauthorized User Creation via API
Summary
A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.
PoC
A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully.
Impact
This allows attackers to create unauthorized accounts.
Пакеты
Наименование
@oneuptime/common
npm
Затронутые версииВерсия исправления
< 9.1.0
9.1.0
Связанные уязвимости
CVSS3: 8.1
nvd
2 месяца назад
OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.