Improper Access Control

2024-07-0307:06:36

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

improper access control

inadequate enforcement

access control policies

graphql api

jqadm frontend

software

CVSS3

3.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

AI Score

6.7

Confidence

High

JSON

aimeos/ai-admin-graphql is vulnerable to Improper Access Control. The vulnerability is due to inadequate enforcement of access control policies within aimeos/ai-admin-graphql, allowing editors are able to manage their own services via the GraphQL API, bypassing the intended restrictions designed for the JQAdm frontend.