CVE-2022-25319

Mô tả

Tham khảo

• cerebrate-project/cerebrate commit a263234 · Patch
• zigrin.com/advisories/cerebrate-endpoints-could-be-open-when-not-enabled · Third Party Advisory
• zigrin.com/cakephp-application-cybersecurity-research-forgotten-endpoint-authentication-bypass-with-open-prefix · Exploit

Lỗ hổng khác của cerebrate

• CVE-2023-41908TRUNG BÌNH 5.3Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
• CVE-2023-41363TRUNG BÌNH 4.3In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.
• CVE-2023-28883NGHIÊM TRỌNG 9.8In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.
• CVE-2023-26468NGHIÊM TRỌNG 9.1Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.
• CVE-2022-25321TRUNG BÌNH 6.1An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.