PT-2020-13205
CVE-2020-12687
·
تاريخ النشر
2020-05-07
·
تاريخ التحديث
2020-05-12
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Serpico versions prior to 1.3.3
Description
An issue was discovered where the "/admin/attacments backup" endpoint can be requested by non-admin authenticated users. This allows an attacker with a user account to retrieve all attachments of all users, including administrators, from the database.
Recommendations
For versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/admin/attacments backup" endpoint to only admin users until a patch is applied.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾