Описание
WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled, users can still create public boards due to incomplete server-side enforcement.
Уязвимые конфигурации
Конфигурация 1Версия до 8.19 (исключая)
cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*
EPSS
Процентиль: 9%
0.0019
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-863
Связанные уязвимости
CVSS3: 4.3
debian
6 месяцев назад
WeKan versions prior to 8.19 contain an authorization logic vulnerabil ...
CVSS3: 4.3
github
6 месяцев назад
WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled, users can still create public boards due to incomplete server-side enforcement.
EPSS
Процентиль: 9%
0.0019
Низкий
4.3 Medium
CVSS3
Дефекты
CWE-863