Xanlar Agamalizade

The plugin fails to verify order ownership before returning a coupon discount calculated for a specific order. This allows unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.

A public proxy endpoint allows fetching URLs on behalf of visitors. Due to a missing authorization check for one specific HTTP request method, the fetched URL is fully controlled by the requester. This allows an unauthenticated attacker to force the server to send requests to arbitrary internal or external hosts. While response bodies are not disclosed, the attacker can receive status codes and selected response headers, enabling the probing of internal hosts and ports.

The software fails to perform a capability check on an AJAX action and exposes the nonce (a unique token used to prevent cross-site request forgery) to all logged-in users. This allows any authenticated user, including those with subscriber-level privileges, to install and activate plugins hosted on the WordPress.org repository.

A SQL injection issue exists in the JasperReports-based reporting feature. A low-privileged authenticated user with `ROLE USER` permissions can exploit this by using the reporting REST API endpoint `POST /rest/reports/{id}` to run the default-enabled reports AssetManagementMaintExpired (Maintenance contracts expired) and AssetManagementMaintStrategy (Maintenance contracts strategy). By providing a malicious `DATE FORMAT` parameter, which is substituted literally and without escaping into SQL queries, an attacker can execute arbitrary SQL commands against the database. This allows for the retrieval of sensitive data, including notification credentials, provisioning secrets, and SNMP community strings.

A missing authorization issue allows unauthenticated configuration changes. The Spring Security policy for the '/api/v2' REST API fails to define authorization rules for the PATCH HTTP method. Consequently, configuration endpoints for event configuration and SNMP data collection are accessible without authentication. An attacker with access to the web UI can disable event definitions and SNMP data collection, which suppresses alarm generation and stops metric collection, leading to a silent degradation of monitoring and detection capabilities.

An issue exists in an AJAX action where the software fails to perform a capability check and does not validate a nonce (a unique token used to prevent replay attacks). This allows users with a Subscriber account to create an unlimited number of options in the database, which are then loaded on every page request.

A JEXL expression sandbox bypass exists in the Measurements REST API. A low-privileged authenticated user can submit a crafted expression to escape the sandbox and load arbitrary Java classes on the server. This could allow an attacker to access confidential information and compromise system integrity. JEXL (Java Expression Language) is a powerful expression language used to evaluate dynamic expressions in Java applications.

The MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent Cross-Site Request Forgery (CSRF) attacks, the server validates a `state` parameter against an internally stored value. A logic flaw in the order of conditionals allows an attacker to bypass this check by providing an `error` query parameter in the request. When the `error` parameter is present, the CSRF validation is skipped, and the server executes a cleanup function that shuts down the local server and terminates the user's active authentication session, resulting in a Denial of Service (DoS).