CVE-2024-0879

Опубликовано: 25 янв. 2024

Источник: nvd

CVSS3: 6.5

CVSS3: 4.3

EPSS Низкий

Описание

Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not owning an authorized email address.

Ссылки

https://github.com/Mintplex-Labs/vector-admin/pull/128/commits/a581b8177dd6be719a5ef6d3ce4b1e939636bb41
Patch
https://research.jfrog.com/vulnerabilities/vector-admin-filter-bypass/
Patch
Third Party Advisory
https://github.com/Mintplex-Labs/vector-admin/pull/128/commits/a581b8177dd6be719a5ef6d3ce4b1e939636bb41
Patch
https://research.jfrog.com/vulnerabilities/vector-admin-filter-bypass/
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mintplexlabs:vector_admin:*:*:*:*:*:*:*:*

Версия до 2024-01-23 (исключая)

EPSS

Процентиль: 8%

0.00028

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-287

Связанные уязвимости

GHSA-fw69-fp6v-v235

CVSS3: 6.5

github

около 2 лет назад

Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not owning an authorized email address.

EPSS

Процентиль: 8%

0.00028

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-287