CVE-2020-11679

Name of the Vulnerable Software and Affected Versions Castel NextGen DVR version 1.0.0

Description The issue allows for privilege escalation through the "Adminstrator/Users/Edit/:UserId" functionality. This is due to the failure of Adminstrator/Users/Edit/:UserId to verify that the request was submitted by an Administrator, enabling a normal user to add additional roles to their account and escalate their privileges.

Recommendations For Castel NextGen DVR version 1.0.0, restrict access to the Adminstrator/Users/Edit/:UserId functionality to prevent unauthorized privilege escalation until a proper fix is implemented.