CVE-2024-0795
Create user API role not enforced
概要
Create user API role not enforced
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an admin role and then be able to use this new account to have elevated privileges on the instance
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com