CVE-2021-31590

PwnDoc all versions until 0.4.0 2021-08-23 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a...

CVE-2021-31590

PwnDoc (up to 0.4.0 as of 2021-08-23) contains a JWT handling flaw that enables improper access control. A valid JSON Web Token used for authentication/authorization can preserve admin privileges when a user is downgraded to “user,” and even after account deletion the attacker can access the admi...

PwnDoc 安全漏洞

PwnDoc is an application. The penetration test report generator PwnDoc version 2021-04-22 and prior versions has a security vulnerability that stems from incorrect JSON Webtoken handling, which could be exploited by an attacker to cause incorrect access control...