Description (CNA)
Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| orthanc-server / orthanc | affected 0 through 1.12.9 |
CWE
CWE-287
References
- https://projectblack.io/blog/orthanc-1-12-9-user-impersonation/#exploitation
- https://discourse.orthanc-server.org/t/orthanc-1-12-10/6326
- https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=252
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.