Описание
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.
Ссылки
EPSS
Процентиль: 45%
0.00551
Низкий
8.1 High
CVSS3
Дефекты
CWE-863
Связанные уязвимости
CVSS3: 8.1
github
около 2 месяцев назад
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.
EPSS
Процентиль: 45%
0.00551
Низкий
8.1 High
CVSS3
Дефекты
CWE-863