| शीर्षक | osuuu LightPicture <=V1.2.2 Improper Handling of Insufficient Permissions or Privileges |
|---|
| विवरण | During a security audit of LightPicture V1.2.2, a critical JWT permission boundary bypass vulnerability was discovered. When a user obtains an administrator-privileged JWT token from one LightPicture instance, this token can be directly used to access other website instances deployed with the same system, bypassing normal authentication mechanisms while maintaining administrator privileges. This vulnerability requires no special attack techniques, and any attacker who obtains a JWT token can easily exploit it. |
|---|
| स्रोत | ⚠️ https://github.com/yuanchaoxxxxx/CVE/issues/4 |
|---|
| उपयोगकर्ता | yuanchao521 (UID 85909) |
|---|
| सबमिशन | 10/07/2025 01:53 AM (1 वर्ष पहले) |
|---|
| संयम | 12/07/2025 01:33 PM (2 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 254855 [osuuu LightPicture तक 1.2.2 TokenVerify.php handle कमजोर एन्क्रिप्शन] |
|---|
| अंक | 0 |
|---|