Geochen

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert user is admin if user query param is provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privilege management. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Prior advisory CVE-2022-44009 was reported as a follow-up on the same sink, but this issue is distinct: it needs no Jinja RBAC und affects default install with RBAC disabled. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api key api.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

**Name of the Vulnerable Software and Affected Versions** Casdoor versions prior to 4.0.0 **Description** An issue exists in the `upload-resource` API within the `controllers/resource.go` file. This flaw allows remote attackers to bypass authentication, leading to missing authentication for the affected component. **Recommendations** Update to a version later than 4.0.0. As a temporary mitigation, restrict access to the `upload-resource` API.

**Name of the Vulnerable Software and Affected Versions** provectus kafka-ui versions prior to 0.7.3 **Description** A code injection flaw exists in the Groovy Code Handler component. A remote attacker can exploit this by manipulating the `executeSmartFilterTest()` function located in the `kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java` file. **Recommendations** As a temporary workaround, consider restricting access to the `executeSmartFilterTest()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Faveo Helpdesk versions prior to 2.0.4 **Description** A path traversal issue exists in the Logo Handler component. A remote attacker can manipulate the `data1` variable passed to the `unlink()` function within the `app/Http/Controllers/Admin/helpdesk/SettingsController.php` file to perform unauthorized file operations. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Faveo Helpdesk versions prior to 2.0.4 **Description** An authentication bypass exists in the `post-ticket-reply` endpoint. This issue occurs within the `FormController::post ticket reply()` function located in the `app/Http/Controllers/Client/helpdesk/FormController.php` file. A remote attacker can exploit this flaw to perform actions without proper authentication. **Recommendations** As a temporary workaround, restrict access to the `post-ticket-reply` endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** elunez eladmin versions prior to 2.8 **Description** Improper authorization occurs within the `EmailController()`, `AliPayController()`, `GeneratorController()`, and `GenConfigController()` functions. This flaw allows a remote attacker to bypass authorization mechanisms. **Recommendations** As a temporary workaround, restrict access to the `EmailController()`, `AliPayController()`, `GeneratorController()`, and `GenConfigController()` functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** jxxghp MoviePilot versions prior to 2.13.6 **Description** An issue exists within the Application API component in the `/jxxghp/MoviePilot` file. A flaw in an unknown function allows for improper authorization, which can be exploited remotely. **Recommendations** Apply the patch identified as `dc2b6910a423b3bfadeffaa303e1ba75cfb33900` for versions prior to 2.13.6.

**Name of the Vulnerable Software and Affected Versions** Bahmni bahmnicore versions prior to 0.93.1 **Description** An issue exists in the Search Endpoint component where the `additionalParams` function within the '/openmrs/ws/rest/v1/bahmnicore/sql' endpoint is susceptible to SQL injection. This occurs when the `test` argument is manipulated, allowing a remote attacker to execute unauthorized SQL commands. **Recommendations** Upgrade to version 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1, or 2.0.1. As a temporary mitigation, restrict access to the '/openmrs/ws/rest/v1/bahmnicore/sql' endpoint or avoid using the `test` argument.

**Name of the Vulnerable Software and Affected Versions** IceHRM versions prior to 35.0.2 **Description** A remote SQL injection flaw exists in the UserReport component within the file `core/src/Reports/User/Reports/EmployeeAttendanceReport.php`. The issue occurs when the `employeeList` argument is manipulated, allowing an attacker to execute unauthorized SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `employeeList` argument in the affected component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** tumf mcp-text-editor versions prior to 1.0.3 **Description** A path traversal issue exists in the ` validate file path()` function within the `mcp text editor/text editor.py` file. This flaw allows a remote attacker to manipulate the `file path` argument to access files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** Update tumf mcp-text-editor to version 1.0.3 or later. As a temporary workaround, restrict access to the ` validate file path()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Harness versions prior to 2.28.2 **Description** A remote authorization bypass exists within the gitspaces component. The issue resides in the `getAuthorizedSpaces()` function located in the `app/api/controller/gitspace/list all.go` file. An attacker can execute a manipulation to bypass authorization controls. **Recommendations** Update Harness to a version later than 2.28.2. As a temporary mitigation, restrict access to the `getAuthorizedSpaces()` function.

**Name of the Vulnerable Software and Affected Versions** bentoml OpenLLM version 0.6.30 **Description** Command injection is possible within the Model Repository Directory Name Handler component. This occurs when the `cmd` argument is manipulated in the `async run command()` function located in the `src/openllm/common.py` file. Successful exploitation requires local access to the system. **Recommendations** As a temporary workaround, restrict access to the `async run command()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** crater-invoice-inc crater versions prior to 6.0.7 **Description** A weakness in the Invoice Note Handler component allows for remote cross site scripting (XSS), a technique where malicious scripts are injected into trusted websites. The issue resides in the `getFormattedString()` function within the `app/Http/Requests/InvoicesRequest.php` file. An attacker can trigger this by manipulating the `notes` argument. **Recommendations** Update crater-invoice-inc crater to version 6.0.7 or later. As a temporary workaround, restrict the use of the `notes` argument in the Invoice Note Handler until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Formbricks version 5.0.0 **Description** Improper access controls exist within the Survey Handler component, specifically affecting a function in the `apps/web/modules/survey/link/actions.ts` file. This flaw allows for remote exploitation. **Recommendations** Upgrade to version 5.1.0-rc.1.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions prior to 4.18.1 **Description** An authorization bypass exists in the `reorder-sets` endpoint. A remote attacker can manipulate the `actionReorderSets()` function within the `src/controllers/GlobalsController.php` file to bypass security checks. **Recommendations** Update to version 4.18.1. As a temporary mitigation, restrict access to the `actionReorderSets()` function.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions prior to 4.18.1 **Description** An improper authorization issue exists in the Charts Endpoint component within the `actionGetNewUsersData()` function of the `src/controllers/ChartsController.php` file. A remote attacker can exploit this by manipulating the `userGroupId` argument. **Recommendations** Upgrade to version 4.18.1.

**Name of the Vulnerable Software and Affected Versions** GitBucket versions prior to 4.46.2 **Description** A server-side request forgery (SSRF) exists that allows remote attackers to manipulate the `url` argument within the `Git.cloneRepository.setURI()` function located in the `src/main/scala/gitbucket/core/service/RepositoryCreationService.scala` file. SSRF is a flaw where an attacker can force the server to make requests to an unintended location. **Recommendations** Deploy patch 487a9b980f56aa73b6a044b1e86a92eed5043215 for versions prior to 4.46.2.

**Name of the Vulnerable Software and Affected Versions** lemonldap-ng versions prior to 2.23.1 **Description** An issue exists in the SAML Common Domain Cookie Endpoint within the library `lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm`. A remote attacker can perform a manipulation of the `url` argument, leading to an open redirect. An open redirect occurs when an application takes a user-provided input and uses it in a redirect without sufficient validation, allowing attackers to redirect users to malicious external sites. **Recommendations** Update to a version later than 2.23.0. Avoid using the `url` argument in the affected SAML Common Domain Cookie Endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ILIAS Learning Management System version 11.0 **Description** An issue exists in the Learning Progress Tracking component within the `ilTrQuery::executeQueries()` function of the `components/ILIAS/Tracking/classes/class.ilTrQuery.php` file. Remote manipulation of the `troup table nav` argument allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.