Описание
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks.
Ссылки
- Product
- ExploitIssue Tracking
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:onyx:onyx:0.27.0:*:*:*:enterprise:*:*:*
EPSS
Процентиль: 12%
0.00041
Низкий
5.4 Medium
CVSS3
Дефекты
CWE-639
Связанные уязвимости
CVSS3: 5.4
github
7 месяцев назад
Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH requests to the /api/manage/admin/user-group/id endpoint, bypassing intended curator-group assignment checks.
EPSS
Процентиль: 12%
0.00041
Низкий
5.4 Medium
CVSS3
Дефекты
CWE-639