Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
Résumé
Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any authenticated user who knows or can discover another user's uploaded avatar filename can delete that file. This issue has been patched in version 4.6.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com