| tiêu đề | Pydio cells v4.2.0 - Broken Access Control and Lack of input validation/sanitization |
|---|
| Mô tả | We identified in Pydio cells v4.2.0 that as a non-admin user, we were able to bypass its current control, which result in the ability of a standard user to create a group within an organization instance (admin role's capability only). When creating a new user as admin (or non-admin user: refer to previously submitted CVE), we can change the naming convention of the username from "user1" to "new/group/user1", which resulted in the creation of: user "user1", group "new", and group "group" in the admin console.
The vendor had been notified, finding had been acknowledged, and advisory to update to Pydio cells version 4.2.1 is released. https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421
Technical write-up of this vulnerability will be published once CVE is assigned. |
|---|
| Nguồn | ⚠️ https://pydio.com/en/community/releases/pydio-cells/pydio-cells-enterprise-421 |
|---|
| Người dùng | ignatiusmichael (UID 28987) |
|---|
| Đệ trình | 30/05/2023 13:58 (cách đây 3 những năm) |
|---|
| Kiểm duyệt | 30/05/2023 15:32 (2 hours later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 230211 [Abstrium Pydio Cells 4.2.0 User Creation nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|