| Titolo | OpenSpug Spug 3.4.0 Missing Authorization |
|---|
| Descrizione | Spug is an open-source lightweight O&M platform for SMEs. In OpenSpug Spug v3.4.0 and earlier, the process/custom-script detection endpoint POST /monitor/test/ does not verify the requesting user's ownership of the target host specified in targets[0], and executes the user-supplied extra parameter (script content / process name) on that host over SSH using credentials held by the platform. A low-privileged authenticated user with only the Monitoring Center add/edit permission can submit an arbitrary host id to execute arbitrary commands on managed hosts it has no permission for, bypassing the product's host-group authorization boundary. |
|---|
| Fonte | ⚠️ https://github.com/SECWG/CVE/issues/11 |
|---|
| Utente | WenGui (UID 82184) |
|---|
| Sottomissione | 28/08/2026 10:33 (1 mese fa) |
|---|
| Moderazione | 10/10/2026 15:37 (1 month later) |
|---|
| Stato | Duplicato |
|---|
| Voce VulDB | 403272 [OpenSpug fino a 3.4.0 /monitor/run_test ping_check escalationi di privilegi] |
|---|
| Punti | 0 |
|---|