Code injection

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...

ThingsBoard 安全漏洞

Thingsboard is a Java-based platform for IOT devices for monitoring, management, and data collection from the Thingsboard team. A security vulnerability exists in ThingsBoard version 3.4.1 that stems from allowing a low-privileged attacker to gain privilege escalation and become an administrator ...

CVE-2022-45608

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...

CVE-2022-45608

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...

CVE-2022-45608

The CVE-2022-45608 entry concerns ThingsBoard 3.4.1 where a low-privilege CUSTOMER_USER can escalate to Administrator roles (TENANT_ADMIN or SYS_ADMIN) in the web app by exploiting an API parameter (authority : value). AFFECTED PRODUCT/COMPONENT: ThingsBoard 3.4.1 web application. ROOT CAUSE: Pri...

PT-2023-14718

Name of the Vulnerable Software and Affected Versions ThingsBoard version 3.4.1 Description An issue in ThingsBoard allows low privileged attackers to gain escalated privileges and become an Administrator on the web application. The attacker must know the corresponding API's parameter authority :...

CVE-2022-45608: Improper Privilege Management

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...

CVE-2022-45608

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...

CVE-2022-48341

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...

CVE-2023-26462

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...

Design/Logic Flaw

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...

Privilege escalation

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...

Thingsboard 安全漏洞

Thingsboard is a Java-based platform for monitoring, management, and data collection of IOT devices from the Thingsboard team. A security vulnerability exists in Thingsboard version 3.4.1, which stems from the fact that a tenant administrator can modify the scope of the scopes parameter to gain...

Thingsboard 信任管理问题漏洞

Thingsboard is a Java-based platform for IOT devices for monitoring, management, and data collection from the Thingsboard team. A security vulnerability exists in ThingsBoard version 3.4.1, which stems from hard-coded service credentials stored in an insecure format that can be exploited by an...

PT-2023-20655 · Unknown · Thingsboard

Name of the Vulnerable Software and Affected Versions: ThingsBoard version 3.4.1 Description: The issue allows a remote attacker to gain elevated privileges due to hard-coded service credentials being stored in an insecure format. To exploit this, an attacker would need access to the application...

CVE-2023-26462

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...

CVE-2022-48341

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...

CVE-2023-26462

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...

CVE-2022-48341

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...

CVE-2022-48341

ThingsBoard 3.4.1 contains a vertical privilege escalation vulnerability where a remote authenticated tenant administrator can gain access to the System Administrator dashboard by modifying the scope parameter (scopes). The issue is triggered by scope manipulation and could allow access to higher...