CVE-2018-8096

Опубликовано: 14 мар. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticationenabled","Value":false' in an api/settings/setting-isauthenticationenabled PUT request.

Ссылки

https://github.com/datalust/seq-tickets/issues/675
Patch
Third Party Advisory
https://medium.com/stolabs/bypass-admin-authentication-on-seq-17f0f9e02732
Exploit
Technical Description
Third Party Advisory
https://www.exploit-db.com/exploits/45136/
Exploit
Third Party Advisory
VDB Entry
https://github.com/datalust/seq-tickets/issues/675
Patch
Third Party Advisory
https://medium.com/stolabs/bypass-admin-authentication-on-seq-17f0f9e02732
Exploit
Technical Description
Third Party Advisory
https://www.exploit-db.com/exploits/45136/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:datalust:seq:*:*:*:*:*:*:*:*

Версия до 4.2.605 (исключая)

EPSS

Процентиль: 92%

0.07421

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-mgvp-g9p3-44hw