CVE-2024-0795
Create user API role not enforced
Résumé
Create user API role not enforced
Description d'origine
La description telle que publiée par la source (souvent en anglais).
If an attacked was given access to an instance with the admin or manager role there is no backend authentication that would prevent the attacked from creating a new user with an admin role and then be able to use this new account to have elevated privileges on the instance
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com