| Название | dibo-software diboot v3.8.0 Broken Access Control |
|---|
| Описание | The tenant administrator management API allows any authenticated user to query and modify another tenant's admin account by supplying a tenantId. Because the controller and service only trust the externally provided tenantId and do not verify the caller's ownership or management permission, an attacker can overwrite tenant admin credentials, realname, status, and account binding information for arbitrary tenants. |
|---|
| Источник | ⚠️ https://drive.google.com/file/d/1D9XNhOV7wkc4dl2M59hTML0pmVF9irbi/view?usp=sharing |
|---|
| Пользователь | Stephen Lin (UID 98370) |
|---|
| Представление | 01.07.2026 09:37 (2 месяцы назад) |
|---|
| Модерация | 31.08.2026 07:33 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 397234 [dibo-software diboot 3.8.0 Tenant Administrator Management API /admin/ tenantId эскалация привилегий] |
|---|
| Баллы | 19 |
|---|