| शीर्षक | cemtan sar2html 4.0.0 Missing Authentication |
|---|
| विवरण | sar2html 4.0.0 exposes three destructive endpoints without any
authentication requirement. Any unauthenticated remote attacker
can permanently delete data from the system.
Affected routes:
- GET /<host_id>/deleteHost — deletes all data for a specific host
- GET /<host_id>/deleteRange — deletes a date range for a specific host
- GET /deleteAll — deletes all data from the entire system
None of these routes perform any authentication or authorization
check before executing destructive database operations. The
application contains no authentication mechanism whatsoever
(no login_required, no before_request, no session checks).
An unauthenticated attacker with network access to the application
can issue a single GET request to /deleteAll to permanently erase
all host data from the system, or target individual hosts via
/<host_id>/deleteHost using sequential integer IDs.
Affected component: sar2html.py, functions deleteHost(),
deleteRange(), deleteAll()
CWE: CWE-306 (Missing Authentication for Critical Function)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
|---|
| स्रोत | ⚠️ https://github.com/cemtan/sar2html/issues/21 |
|---|
| उपयोगकर्ता | spoo1k (UID 101695) |
|---|
| सबमिशन | 28/09/2026 11:00 AM (18 दिन पहले) |
|---|
| संयम | 14/10/2026 03:12 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 419829 [cemtan sar2html 4.0.0 sar2html.py deleteHost/deleteRange/deleteAll कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|