PT-2018-15301 · Steve Pallen · Coherence

Griffinmb · Publicado 2018-12-20 · Atualizado 2022-02-10 · CVE-2018-20301

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Steve Pallen Coherence versions prior to 0.5.2

Description An issue similar to a Mass Assignment vulnerability was discovered, affecting "registration" endpoints such as creating, editing, and updating. This allows users to update any coherence fields data. For instance, users can automatically confirm their accounts by sending the confirmed at parameter with their registration request to the "registration" endpoint.

Recommendations For versions prior to 0.5.2, update to version 0.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the confirmed at parameter in registration requests until the update is applied.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-20301

GHSA-MRQ8-53R4-3J5M

Produtos afetados

Coherence

Referências · 5

• https://github.com/smpallen99/coherence/issues/270 · Nota
• https://github.com/smpallen99/coherence · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-20301 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mrq8-53r4-3j5m · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-20301 · Aviso do Fabricante