Beveiligingsadvies

CVE-2024-0550

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2024-02-28 04:52:21

Laatst bijgewerkt 2024-08-22 19:40:03

Toegewezen door @huntr_ai

CVSS-score 9.6

Status PUBLISHED

Beschrijving

A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack.

← Alle CVE's bekijken Bekijk op cve.org ↗