6 matches found
CVE-2024-57190
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...
CVE-2024-57190
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...
CVE-2024-57190
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...
CVE-2024-57190
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...
CVE-2024-57190
Affected software: Erxes prior to 1.6.1. Vulnerability: Incorrect Access Control enabling authentication bypass by sending a User header containing any user, allowing access to any GraphQL endpoint. Root cause: improper validation of the User header leading to auth bypass. Impact: high confidenti...
CVE-2024-57190
Erxes 1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint...