Sonlogger · Sonlogger · CVE-2021-27963
Name of the Vulnerable Software and Affected Versions:
SonLogger versions prior to 6.4.1
Description:
The issue allows an anonymous user to create a new user with any user permissions profile, such as SuperAdmin, by sending a POST request to the /User/saveUser endpoint without any authentication or session header.
Recommendations:
For versions prior to 6.4.1, update to version 6.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /User/saveUser endpoint to prevent unauthorized user creation.