PT-2021-10898 · Unknown · Newbee-Mall
Jayway007
·
Published
2021-01-26
·
Updated
2021-07-21
·
CVE-2020-23448
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
newbee-mall all versions
Description
The issue concerns incorrect access control, allowing remote privilege escalation through the
AdminLoginInterceptor.java file. Specifically, the authentication logic for the system's background /admin area, coded in AdminLoginInterceptor, can be bypassed.Recommendations
For all versions, consider restricting access to the
AdminLoginInterceptor function until a proper fix is implemented to prevent unauthorized access and privilege escalation. As a temporary workaround, review and reinforce the authentication logic to prevent bypassing, focusing on securing the background /admin area.Exploit
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Newbee-Mall