Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the PUT /api/environments/id/templates/variables endpoint. An attacker can overwrite global environment variables used in all project deployments by sending requests as an authenticated non-admin user,...

Malicious callers can replay change orders

Lines of code Vulnerability details Unlike some of the other signature based operations in the Rigor system, change order signatures do not include a nonce and are vulnerable to replay attacks. A number of exploits are possible using replayed change orders, including subcontractors extracting...