| शीर्षक | 郑州卡卡罗特软件科技有限公司 WukongCRM WukongCRM-11.x-JAVA logical flaw vulnerability |
|---|
| विवरण |
There is a flaw in the whitelist release logic for Swagger document paths (/v2/app docs) in PermissionServiceImpl. java. Attackers can deceive through URL endings (such as/target/app///; Bypass Gateway authentication and ultimately obtain all permissions for the web system. This vulnerability can tamper with any user's password, query any data credentials, and cause the system to crash, posing risks of full information leakage and data addition, deletion, modification, and querying. |
|---|
| स्रोत | ⚠️ https://github.com/SourByte05/SourByte-Lab/issues/8 |
|---|
| उपयोगकर्ता | sourbyte (UID 94279) |
|---|
| सबमिशन | 27/01/2026 10:16 AM (9 महीनों पहले) |
|---|
| संयम | 06/02/2026 10:06 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 344776 [WuKongOpenSource WukongCRM तक 11.3.3 URL PermissionServiceImpl.java अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|