Non évaluée
Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm accou...
CVE-2018-20345
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=" query filter parameters. Enterprise editions with RBAC enabled are not affected.
Références
- advisory stackstorm.com