Lucene search
GoogleOSV:GHSA-8HW9-22V6-9JR9HistoryApr 19, 2021 - 3:14 p.m.
Any logged in user could edit any other logged in user.
2021-04-1915:14:33
Google
osv.dev
8
0.001 Low
EPSS
Percentile
22.9%
Impact
Everyone who is running a12n-server.
A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change.
Patches
Patched in v0.18.2
| CPE | Name | Operator | Version |
|---|---|---|---|
| @curveball/a12n-server | ge | 0.18.0 | |
| @curveball/a12n-server | lt | 0.18.2 |
Related
nvd
nvd
CVE-2021-29452
2021-04-16 22:15:14
osv
osv
CVE-2021-29452
2021-04-16 22:15:14
cvelist
cvelist
CVE-2021-29452 Any logged in user could edit any other logged in user.
2021-04-16 21:35:15
github
github
Any logged in user could edit any other logged in user.
2021-04-19 15:14:33
cve
cve
CVE-2021-29452
2021-04-16 22:15:14
veracode
veracode
Insecure Access Controls
2021-04-19 06:09:58
prion
prion
Authentication flaw
2021-04-16 22:15:00