Gladys Assistant up to 4.45.0 user.controller.js updateMySelf resource consumption

Summaryinfo

A vulnerability was found in Gladys Assistant up to 4.45.0. It has been declared as problematic. Affected by this vulnerability is the function updateMySelf of the file server/api/controllers/user.controller.js. The manipulation results in an unknown weakness. This vulnerability is identified as CVE-2024-47210. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Gladys Assistant up to 4.45.0. Affected is the function updateMySelf of the file server/api/controllers/user.controller.js. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-47210 since 09/21/2024. There are known technical details, but no exploit is available.

Upgrading to version 4.45.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 344ad9b8ca3078d9292dd95f2dd7b9172bc6ebbe is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Gladys

Name

• Assistant

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16
• 4.17
• 4.18
• 4.19
• 4.20
• 4.21
• 4.22
• 4.23
• 4.24
• 4.25
• 4.26
• 4.27
• 4.28
• 4.29
• 4.30
• 4.31
• 4.32
• 4.33
• 4.34
• 4.35
• 4.36
• 4.37
• 4.38
• 4.39
• 4.40
• 4.41
• 4.42
• 4.43
• 4.44
• 4.45.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion