Описание
ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter.
Ссылки
- Third Party AdvisoryVDB Entry
- Release Notes
- Third Party AdvisoryVDB Entry
- Release Notes
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:thingsboard:thingsboard:3.4.1:*:*:*:*:*:*:*
EPSS
Процентиль: 57%
0.00351
Низкий
8.8 High
CVSS3
Дефекты
NVD-CWE-Other
CWE-269
Связанные уязвимости
CVSS3: 8.8
github
почти 3 года назад
ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter.
EPSS
Процентиль: 57%
0.00351
Низкий
8.8 High
CVSS3
Дефекты
NVD-CWE-Other
CWE-269