| शीर्षक | Open Web Analytics master Authentication Bypass |
|---|
| विवरण | Open Web Analytics (OWA) contains an authentication bypass vulnerability in the core controller layer. The checkCapabilityAndAuthenticateUser() method in Core/Controller.php has a logic flaw: when a controller does not explicitly set a required capability via setRequiredCapability() and no authentication cookies are present, the entire authentication check is skipped. This allows unauthenticated remote attackers to execute controller actions that should require authentication, including ProcessEvent and other controllers that do not declare required capabilities.
|
|---|
| स्रोत | ⚠️ https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/959 |
|---|
| उपयोगकर्ता | Customeres (UID 86596) |
|---|
| सबमिशन | 30/07/2026 05:49 PM (1 महीना पहले) |
|---|
| संयम | 08/09/2026 03:32 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 399814 [Open-Web-Analytics तक 1.9.1 Controller Core/Controller.php checkCapabilityAndAuthenticateUser कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|