PT-2020-14201 · Unknown · I Hate Money

Zorun · Published 2020-07-27 · Updated 2020-07-29 · CVE-2020-15120

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions I Hate Money versions prior to 4.1.5

Description An authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project, making it trivial for an attacker to become authenticated and exploit this flaw. The issue can be exploited through API endpoints such as "PUT /api/projects//members/" and "DELETE /api/projects//members/", as well as through the web interface at "//members//edit".

Recommendations To fix the issue, update to version 4.1.5. As a temporary workaround, consider setting ALLOW PUBLIC PROJECT CREATION = False in the configuration to limit the impact, although existing users will still be able to exploit the flaw.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-15120

GHSA-67J9-C52G-W2Q9

PYSEC-2020-264

Affected Products

I Hate Money

References · 8

• https://github.com/spiral-project/ihatemoney/commit/8d77cf5d5646e1d2d8ded13f0660638f57e98471 · Patch
• https://osv.dev/vulnerability/CVE-2020-15120 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67j9-c52g-w2q9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15120 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-264 · Vendor Advisory
• https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9 · Note
• https://github.com/spiral-project/ihatemoney · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ihatemoney/PYSEC-2020-264.yaml · Note