PT-2026-85056
CVE-2026-84989
·
تاريخ النشر
2026-09-03
·
تاريخ التحديث
2026-09-04
الوصف من
CVSS 3.1
7.1
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Name of the Vulnerable Software and Affected Versions
ntopng versions 6.7.0 through 6.7.260717
Description
Two REST v2 endpoints used to manage the tag/badge feature lack authorization checks. This allows any authenticated user, including those with unprivileged accounts, to delete or rename any tag in the system, regardless of whether the tag was created by an administrator. The affected endpoints are
POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua.Recommendations
Update to version 6.7.260718.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾