1 matches found
Parser Server's streaming file download bypasses afterFind file trigger authorization
Impact File downloads via HTTP Range requests bypass the afterFindParse.File trigger and its validators on storage adapters that support streaming e.g. the default GridFS adapter. This allows access to files that should be protected by afterFind trigger authorization logic or built-in validators...
8.2CVSS5.9AI score0.00378EPSS
SaveExploits0References7Affected Software1
20