| Название | WeiYe-Jing DataX-Web <= 2.1.2 Broken Access Control / Horizontal Privilege Escalation |
|---|
| Описание | DataX-Web is a distributed data synchronization tool with multi-user support. The system has a permission model where users can have different roles (admin or regular user) and permissions to access specific job groups. However, critical task management operations (remove, update, start, stop, trigger) do not implement the designed access control checks, allowing users to perform unauthorized operations on tasks they don't own. |
|---|
| Источник | ⚠️ https://github.com/Xzzz111/exps/blob/main/archives/datax-web-broken-access-control-1/report.md |
|---|
| Пользователь | sh7err (UID 91441) |
|---|
| Представление | 02.11.2025 16:47 (12 месяцы назад) |
|---|
| Модерация | 15.11.2025 16:05 (13 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 332584 [WeiYe-Jing datax-web до 2.1.2 Job remove/update/pause/start/triggerJob эскалация привилегий] |
|---|
| Баллы | 19 |
|---|