Description (CNA)
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OliveTin / OliveTin | affected < 3000.11.0 |
CWE
CWE-284, CWE-862, CWE-863
References
- https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq
- https://github.com/OliveTin/OliveTin/commit/d9804182eae43cf49f735e6533ddbe1541c2b9a9
- https://github.com/OliveTin/OliveTin/releases/tag/3000.11.0
ADP enrichment
No English description supplied.