Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
概要
Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com