Описание
youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may allow non-root users to directly access root roles.
Ссылки
- Third Party Advisory
- Patch
- ExploitIssue TrackingVendor Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:youlai:youlai-boot:2.21.1:*:*:*:*:*:*:*
EPSS
Процентиль: 11%
0.00036
Низкий
7.5 High
CVSS3
Дефекты
CWE-284
Связанные уязвимости
CVSS3: 7.5
github
около 2 месяцев назад
youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may allow non-root users to directly access root roles.
EPSS
Процентиль: 11%
0.00036
Низкий
7.5 High
CVSS3
Дефекты
CWE-284