NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS
Résumé
NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS
Description d'origine
La description telle que publiée par la source (souvent en anglais).
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit prototype pollution in the /api/v2/meta/connection/test endpoint, causing all database write operations to fail application-wide until server restart. While the pollution technically bypasses SUPER_ADMIN authorization checks, no practical privileged actions can be performed because database operations fail immediately after pollution. Version 0.301.0 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov