Insecure Access Control

2021-02-2302:41:53

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

insecure access control

api functions

js proto method

api key manipulation.

EPSS

0.002

Percentile

53.5%

JSON

shinobi uses insecure access controls. An attacker is able to access the User/Admin/Super API functions through the use of JS Proto Method names held in an internal JS Object and trick the System into accepting supplied API Key that exists in the underlying JS object.