PT-2024-38106 · Pulp · Pulp
Robb Gatica
·
Published
2024-08-07
·
Updated
2026-03-21
·
CVE-2024-7143
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Pulp (affected versions not specified)
Description
A flaw was found in the Pulp package related to role-based access control (RBAC) objects. When an RBAC object is set to assign permissions on its creation, it uses the
AutoAddObjPermsMixin, typically the add roles for object creator method. This method finds the object creator by checking the current authenticated user. For objects created within a task, the current user is set by the first user with any permissions on the task object. This results in the oldest user with model/domain-level task permissions being set as the current user of a task, even if they didn't dispatch the task. Consequently, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pulp