Gladys Assistant Security Vulnerabilities and Issues — Gladys Assistant CVE List

Lucene search

GladysassistantGladys Assistant

3 matches found

CVE•added 2024/09/21 11:15 p.m.•74 views

CVE-2024-47210

Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySelf in server/api/controllers/user.controller.js.

8.8CVSS7.2AI score0.00254EPSS

CVE•added 2023/09/25 2:15 p.m.•49 views

CVE-2023-43256

A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by exploiting a non-sanitized user input.

6.5CVSS6.2AI score0.00125EPSS

CVE•added 2023/12/07 6:15 p.m.•25 views

CVE-2023-47440

Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. The patch of CVE-2023-43256 was found to be incomplete, allowing authenticated attackers to extract sensitive files in the host machine.

6.5CVSS6.2AI score0.00487EPSS