Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-50566 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-08-02T22:16:47.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/weng-xianhu/eyoucms/issues/56
CVE ID: CVE-2023-50569 State: REJECTED Published: 2023-12-22T00:00:00 Last Updated: 2024-08-15T16:03:42.279606 Description: No description available.
CVE ID: CVE-2023-50570 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-09-03T19:55:34.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because an infinite loop occurs only for cases in which the developer supplies invalid arguments. The product is not intended to always halt for contrived inputs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/seancfoley/IPAddress/issues/118
CVE ID: CVE-2023-50571 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-02T22:16:47.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/j-easy/easy-rules/issues/419
CVE ID: CVE-2023-50572 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-02T22:16:47.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jline/jline3/issues/909
CVE ID: CVE-2023-50578 State: PUBLISHED Published: 2023-12-30T00:00:00 Last Updated: 2024-09-09T20:46:14.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/mingSoft/MCMS/issues/I8MAJK
CVE ID: CVE-2023-50585 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-03T14:34:10.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LaPhilosophie/IoT-vulnerable/blob/main/Tenda/A18/formSetDeviceName.md
CVE ID: CVE-2023-50589 State: PUBLISHED Published: 2023-12-30T00:00:00 Last Updated: 2024-08-02T22:16:47.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page. Additional Analyst Notes: - CVE Program Container: References: - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - https://owasp.org/www-community/attacks/SQL_Injection - https://github.com/VauP/CVE-IDs/blob/main/proof_of_concept.md
CVE ID: CVE-2023-50609 State: PUBLISHED Published: 2024-01-06T00:00:00.000Z Last Updated: 2025-06-03T14:40:37.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via a crafted script to ajax.aspx. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/zhishituboshu/f8f07e9df411b1ee3d8212a166b2034e
CVE ID: CVE-2023-50612 State: PUBLISHED Published: 2024-01-06T00:00:00.000Z Last Updated: 2025-06-03T14:40:43.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yaowenxiao721/CloudExplorer-Lite-v1.4.1-vulnerability-BOPLA
CVE ID: CVE-2023-50614 State: PUBLISHED Published: 2024-01-18T00:00:00.000Z Last Updated: 2025-06-02T15:04:38.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cvdyfbwa/Password-plaintext-output/blob/main/README.md
CVE ID: CVE-2023-50628 State: PUBLISHED Published: 2023-12-20T00:00:00 Last Updated: 2024-08-27T18:46:07.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive information via parser.c component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/289 - https://github.com/libming/libming/pull/290
CVE ID: CVE-2023-50630 State: PUBLISHED Published: 2024-01-04T00:00:00.000Z Last Updated: 2025-04-17T18:34:39.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script to the click here function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xiweicheng/tms/issues/19
CVE ID: CVE-2023-50639 State: PUBLISHED Published: 2023-12-20T00:00:00 Last Updated: 2024-08-02T22:16:47.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in CuteHttpFileServer v.1.0 and v.2.0 allows attackers to obtain sensitive information via the file upload function in the home page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/940198871/Vulnerability-details/blob/main/CVE-2023-50639.md
CVE ID: CVE-2023-50643 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-03T14:34:23.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://evernote.com - https://github.com/V3x0r/CVE-2023-50643 - https://www.electronjs.org/blog/statement-run-as-node-cves
CVE ID: CVE-2023-50651 State: PUBLISHED Published: 2023-12-30T00:00:00.000Z Last Updated: 2025-04-17T20:02:06.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://totolink.com - https://palm-jump-676.notion.site/X6000R-sub_4119A0-11-b35b4ca36ce84e07afff85c98414d293
CVE ID: CVE-2023-50658 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T22:16:47.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317 - https://github.com/dvsekhvalnov/jose2go/compare/v1.5.0...v1.6.0
CVE ID: CVE-2023-50671 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-17T15:29:46.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: In exiftags 1.01, nikon_prop1 in nikon.c has a heap-based buffer overflow (write of size 28) because snprintf can write to an unexpected address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.yulun.ac.cn/posts/2023/fuzzing-exiftags/ - https://johnst.org/sw/exiftags/
CVE ID: CVE-2023-50677 State: PUBLISHED Published: 2024-03-14T00:00:00 Last Updated: 2024-08-14T18:56:53.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file parameter to the /setup.cgi component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/DMIND-NLL/b61b8d8d20271adf60fc717b3b48faff
CVE ID: CVE-2023-50685 State: PUBLISHED Published: 2024-05-02T00:00:00 Last Updated: 2024-08-16T18:22:11.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Hipcam Cameras RealServer v.1.0 allows a remote attacker to cause a denial of service via a crafted script to the client_port parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/UnderwaterCoder/Hipcam-RTSP-Format-Validation-Vulnerability
CVE ID: CVE-2023-50692 State: PUBLISHED Published: 2023-12-28T00:00:00.000Z Last Updated: 2025-04-17T20:31:51.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Cherry-toto/jizhicms/issues/91
CVE ID: CVE-2023-50693 State: PUBLISHED Published: 2024-01-19T00:00:00.000Z Last Updated: 2025-05-30T14:26:54.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Jester v.0.6.0 and before allows a remote attacker to send a malicious crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dom96/jester/issues/326 - https://github.com/dom96/jester/pull/327 - https://gist.github.com/anas-cherni/dd297786750f300a2bab3bb73fee919b
CVE ID: CVE-2023-50694 State: PUBLISHED Published: 2024-01-19T00:00:00.000Z Last Updated: 2025-06-17T16:00:17.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to send a malicious crafted request due to insufficient parsing in the parser.nim component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dom96/httpbeast/pull/96 - https://github.com/dom96/httpbeast/issues/95 - https://gist.github.com/anas-cherni/c95e2fc1fd84d93167eb60193318d0b8
CVE ID: CVE-2023-50700 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-08-02T22:16:47.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Deepin dde-file-manager 6.0.54 and earlier allows privileged operations to be called by unprivileged users via the D-Bus method. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.opensuse.org/show_bug.cgi?id=1134131 - https://bugzilla.opensuse.org/show_bug.cgi?id=1134132 - https://github.com/linuxdeepin/developer-center/issues/10007
CVE ID: CVE-2023-50702 State: PUBLISHED Published: 2024-03-26T00:00:00 Last Updated: 2024-08-08T15:44:07.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged users have write access to %PROGRAMDATA%\SSCService). Consequently, low-privileged users can execute arbitrary code as LocalSystem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.youtube.com/watch?v=3dCoV33y1WY
CVE ID: CVE-2023-50703 State: PUBLISHED Published: 2023-12-19T23:40:49.215Z Last Updated: 2024-08-02T22:16:47.115Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: EFACEC Products: UC 500E Problem Types: CWE-319 Description: An attacker with network access could perform a man-in-the-middle (MitM) attack and capture sensitive information to gain unauthorized access to the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03
CVE ID: CVE-2023-50704 State: PUBLISHED Published: 2023-12-19T23:43:11.595Z Last Updated: 2024-09-16T18:27:57.707Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: EFACEC Products: UC 500E Problem Types: CWE-601 Description: An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate phishing attacks against application users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03
CVE ID: CVE-2023-50705 State: PUBLISHED Published: 2023-12-19T23:45:17.101Z Last Updated: 2024-08-02T22:16:47.250Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: EFACEC Products: UC 500E Problem Types: CWE-200 Description: An attacker could create malicious requests to obtain sensitive information about the web server. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03
CVE ID: CVE-2023-50706 State: PUBLISHED Published: 2023-12-19T23:47:49.654Z Last Updated: 2024-08-02T22:16:47.352Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: EFACEC Products: UC 500E Problem Types: CWE-284 Description: A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or valid session tokens. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-03
CVE ID: CVE-2023-50707 State: PUBLISHED Published: 2023-12-19T23:18:26.771Z Last Updated: 2024-08-02T22:16:47.195Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: EFACEC Products: BCU 500 Problem Types: CWE-400 Description: Through the exploitation of active user sessions, an attacker could send custom requests to cause a denial-of-service condition on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-02
CVE ID: CVE-2023-50708 State: PUBLISHED Published: 2023-12-22T18:25:01.925Z Last Updated: 2024-08-02T22:16:47.124Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: yiisoft Products: yii2-authclient Problem Types: CWE-203 Description: yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are avai
ii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp - https://github.com/yiisoft/yii2-authclient/commit/dabddf2154ab7e7703740205a069202554089248 - https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 - https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 - https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.p
.php#L121 - https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420
CVE ID: CVE-2023-50709 State: PUBLISHED Published: 2023-12-13T22:00:04.603Z Last Updated: 2024-10-08T14:25:19.426Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: cube-js Products: cube Problem Types: CWE-20 Description: Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption. There are currently no workaround for older versions, and the
grade to the latest version to prevent service disruption. There are currently no workaround for older versions, and the recommendation is to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cube-js/cube/security/advisories/GHSA-9759-3276-g2pm - https://github.com/cube-js/cube/releases/tag/v0.34.34
CVE ID: CVE-2023-50710 State: PUBLISHED Published: 2023-12-14T17:22:26.836Z Last Updated: 2024-08-02T22:16:47.211Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: honojs Products: hono Problem Types: CWE-94 Description: Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter. Version 3.11.7 includes t
y or when the application matches a pattern that is not supported by the default RegExpRouter. Version 3.11.7 includes the change to fix this issue. As a workaround, avoid using TrieRouter directly. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/honojs/hono/security/advisories/GHSA-f6gv-hh8j-q8vq - https://github.com/honojs/hono/commit/8e2b6b08518998783f66d31db4f21b1b1eecc4c8 - https://github.com/honojs/hono/releases/tag/v3.11.7
CVE ID: CVE-2023-50711 State: PUBLISHED Published: 2024-01-02T20:02:28.225Z Last Updated: 2025-02-13T17:19:28.284Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: rust-vmm Products: vmm-sys-util Problem Types: CWE-787 Description: vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the `FamStructWrapper::deserialize` implementation provided by the crate for `vmm_sys_util::fam::FamStructWrapper` can lead to out of bounds memory accesses. The deserialization does not check that the length stored in the header matches the flexible arr
bounds memory accesses. The deserialization does not check that the length stored in the header matches the flexible array length. Mismatch in the lengths might allow out of bounds memory access through Rust-safe methods. The issue was corrected in version 0.12.0 by inserting a check that verifies the lengths of compared flexible arrays are equal for any deserialized header and aborting deserialization otherwise. Moreover, the API was changed so that header length can only be modified through Rust-unsafe code. This ensures that users cannot trigger out-of-bounds memory access from Rust-safe code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
ss from Rust-safe code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rust-vmm/vmm-sys-util/security/advisories/GHSA-875g-mfp6-g7f9 - https://github.com/rust-vmm/vmm-sys-util/commit/30172fca2a8e0a38667d934ee56682247e13f167 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5XMCLV2P3ANS3XN4NXZTV4PUNTLWUNJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJI7D273R6G5RUC246KTI2YY3AXZKZMD/
CVE ID: CVE-2023-50712 State: PUBLISHED Published: 2023-12-22T19:19:31.379Z Last Updated: 2024-08-02T22:16:47.311Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: dfir-iris Products: iris-web Problem Types: CWE-87, CWE-79 Description: Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This co
malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.3.7 of iris-web. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dfir-iris/iris-web/security/advisories/GHSA-593r-747g-p92p - https://github.com/dfir-iris/iris-web/releases/tag/v2.3.7
CVE ID: CVE-2023-50713 State: PUBLISHED Published: 2023-12-14T18:08:57.974Z Last Updated: 2024-08-02T22:16:47.265Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N) Vendors: specklesystems Products: speckle-server Problem Types: CWE-1220 Description: Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17.6 affects users who: authorized an application which requested a 'token write' scope or, using frontend-2, created a Personal Access Token (PAT) with `token write` scope. When creating a new token an agent needs to authorise the request with an existing token (the '
ith `token write` scope. When creating a new token an agent needs to authorise the request with an existing token (the 'requesting token'). The requesting token is required to have token write scope in order to generate new tokens. However, Speckle server was not verifying that other privileges granted to the new token were not in excess of the privileges of the requesting token. A malicious actor could use a token with only token write scope to subsequently generate further tokens with additional privileges. These privileges would only grant privileges up to the existing privileges of the user. This vulnerability cannot be used to escalate a user's privileges or grant privileges on behalf o
rivileges of the user. This vulnerability cannot be used to escalate a user's privileges or grant privileges on behalf of other users. This has been patched as of version 2.17.6. All operators of Speckle servers should upgrade their server to version 2.17.6 or higher. Any users who authorized an application with 'token write' scope, or created a token in frontend-2 with `token write` scope should review existing tokens and permanently revoke any they do not recognize, revoke existing tokens and create new tokens, and review usage of their account for suspicious activity. No known workarounds for this issue exist. Additional Analyst Notes: - CVE Program Container: References: - https://github