PT-2026-80863
CVE-2026-78369
·
تاريخ النشر
2026-08-24
·
تاريخ التحديث
2026-08-24
الوصف من
CVSS 4.0
8.8
عاليةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
RansomLook (affected versions not specified)
Description
A missing authentication flaw exists in the '/admin/crypto/group/new' endpoint. This endpoint, intended for the administrative creation of new crypto group entries, lacks protection from the application's authentication mechanism. An unauthenticated remote attacker with access to the web interface can submit requests to this endpoint to create crypto group entries without a valid session or administrative credentials. This allows unauthorized modifications to data restricted to administrators and may compromise the integrity of information processed or presented by the application.
Recommendations
Apply the
flask login.login required decorator to the '/admin/crypto/group/new' route to ensure only authenticated users can access this functionality.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾