Netmaker: Privilege Escalation from Admin to Super-Admin via User Update
Résumé
Netmaker: Privilege Escalation from Admin to Super-Admin via User Update
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Netmaker makes networks with WireGuard. Prior to version 1.5.0, the user update handler (PUT /api/users/{username}) lacks validation to prevent an admin-role user from assigning the super-admin role during account updates. While the code correctly blocks an admin from assigning the admin role to another user, it does not include an equivalent check for the super-admin role. This issue has been patched in version 1.5.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com