CVE-2024-31525

Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result...

CVE-2024-31525: Missing Authentication for Critical Function

Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result...

PT-2025-9846

Name of the Vulnerable Software and Affected Versions Peppermint Ticket Management version 0.4.6 Description The issue concerns Incorrect Access Control, where a regular registered user can elevate their privileges to admin and gain complete access to the system. This occurs because the...

CVE-2024-31525

Peppermint Ticket Management version 0.4.6 is vulnerable to Incorrect Access Control due to an authorization mechanism that is only validated on the client side rather than the server side. This flaw allows a regular registered user to elevate their privileges to admin , granting them complete sy...

Peppermint 访问控制错误漏洞

Peppermint is an open source ticket management system from Peppermint Labs. A security vulnerability exists in Peppermint version 0.4.6 that stems from improper access control that allows a regular user to elevate privileges to administrator...

CVE-2023-46864

Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request...

CVE-2023-46863

Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request...

CVE-2023-46863

Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request...

CVE-2023-46864

Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request...

Cross site request forgery (csrf)

Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request...

CVE-2023-46863

Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request...

CVE-2023-46864

Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request...

CVE-2023-46863

Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request...

CVE-2023-46863

Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request...

CVE-2023-46864

Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request...

PT-2023-30248 · Unknown · Peppermint Ticket Management

Name of the Vulnerable Software and Affected Versions: Peppermint Ticket Management versions 0.2.4 and earlier Description: The issue allows remote attackers to read arbitrary files via a "/api/v1/ticket/1/file/download?filepath=../" POST request. This is achieved by exploiting the filepath...

PT-2023-30247 · Unknown · Peppermint Ticket Management

Name of the Vulnerable Software and Affected Versions: Peppermint Ticket Management versions prior to 0.2.4 Description: The issue allows remote attackers to read arbitrary files via a "/api/v1/users/file/download?filepath=./../" POST request. This is a significant security concern as it...

CVE-2023-46863

Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request...

CVE-2023-46864

Peppermint Ticket Management vulnerability CVE-2023-46864 affects versions up to 0.2.4. The issue is a path traversal in the API endpoint /api/v1/ticket/1/file/download?filepath=../, allowing remote attackers to read arbitrary files. Root cause: the filepath parameter is not properly validated, e...

CVE-2023-46863

Peppermint Ticket Management before 0.2.4 is affected by a directory-traversal flaw that allows remote attackers to read arbitrary files through a POST to /api/v1/users/file/download?filepath=./../. The issue concerns the file download API handling of the filepath parameter and is confirmed acros...