Description (CNA)
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| JTL SW GmbH / JTL-WMS | affected 0 before 2.0.7; affected 0 before 2.1.2; affected 0 before 2.2.1; affected 1.7.*, 1.8.*, 1.9.*, 1.10.*, 1.11.* |
CWE
CWE-306
References
ADP enrichment
No English description supplied.
No references supplied.