Description (CNA)
Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ikus-soft / rdiffweb | affected 0 before 2.10.6 |
CWE
CWE-862
References
- https://gitlab.com/ikus-soft/rdiffweb
- https://gitlab.com/ikus-soft/rdiffweb/-/commit/b529adf2c13a210d10aaf56325de4d3fb2428abe
- https://gitlab.com/ikus-soft/rdiffweb/-/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3
ADP enrichment
No English description supplied.
No references supplied.