| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| github.com/gravitl/netmaker | < 0.15.1 | 0.15.1 |
| netmaker | < 0.15.1 | 0.15.1 |
Improper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.
In addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.
This problem has been patched in v0.15.1. To apply:
If you have any questions or comments about this advisory:
Email us at [email protected] This vulnerability was brought to our attention by @tweidinger
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí