PT-2023-29052 · Dromara · Dromara Satoken
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Dromara SaToken versions 1.3.50RC and earlier
Description
An issue in Dromara SaToken when using Spring dynamic controllers may cause an authentication bypass due to a specially crafted request.
Recommendations
For Dromara SaToken versions 1.3.50RC and earlier, update to a version later than 1.3.50RC to resolve the issue.
As a temporary workaround, consider restricting access to Spring dynamic controllers until a patch is available.
Exploit
Fix
Improper Authentication
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Dromara Satoken