| Название | AIP-PUB ACPs-community main @ commit 8334e6b (v2.2.0) Missing Authentication |
|---|
| Описание | A vulnerability was found in AIP-PUB ACPs-community up to commit 8334e6b (v2.2.0). This affects the component Discovery Server of the file discovery-server/app/main.py. The endpoints /admin/dsp/status, /admin/dsp/start, /admin/dsp/stop, /admin/dsp/sync, /admin/dsp/reset, /admin/dsp/hard-reset, /admin/dsp/registry-info, /admin/dsp/webhooks/register, /admin/alive-sync/status and /admin/alive-sync/resync can be called without any authentication. It is possible to launch the attack remotely without authentication: POST /admin/dsp/hard-reset deletes all agent data, POST /admin/dsp/stop disables synchronization, and repeated POST /admin/dsp/sync or POST /admin/dsp/reset forces full synchronization cycles. GET /admin/dsp/registry-info discloses the internal registry connection details. The affected service is exposed on port 9005, including in the packaged deployment templates. |
|---|
| Источник | ⚠️ https://github.com/AIP-PUB/ACPs-community/issues/12 |
|---|
| Пользователь | Evo1ution (UID 101872) |
|---|
| Представление | 18.10.2026 07:42 (26 дни назад) |
|---|
| Модерация | 12.11.2026 18:29 (25 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 436435 [AIP-PUB ACPs-community до 2.2.0 Discovery Server main.py слабая аутентификация] |
|---|
| Баллы | 20 |
|---|