CVE-2020-11679

Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation via Adminstrator/Users/Edit/:UserId, where requests aren’t checked for admin authority, enabling a normal user to add roles and gain administrator privileges. The issue is fixed in v1.0.1 per linked disclosures; CVSS data in sources ...

PT-2020-12767

Name of the Vulnerable Software and Affected Versions Castel NextGen DVR version 1.0.0 Description The issue allows for privilege escalation through the "Adminstrator/Users/Edit/:UserId" functionality. This is due to the failure of Adminstrator/Users/Edit/:UserId to verify that the request was...

CVE-2020-11679: Missing Authorization

Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/Users/Edit/:UserId fails to check that the request was submitted by an Administrator. This allows a normal user to escalate their privileges by adding additional...