CVE-2022-1770 (JavaScript, published 2022-05-20T18:15Z)
Description: value: Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/polonel/trudesk
Files changed:
src/controllers/api/v2/routes.js
Commit message: refactor(core): apiv2 route enhancements

Vulnerable code:
 *  Updated:    2/14/19 12:07 AM
  router.get('/api/v2/accounts', apiv2Auth, apiv2.accounts.get)
  router.post('/api/v2/accounts', apiv2Auth, apiv2.accounts.create)
  router.put('/api/v2/accounts/:username', apiv2Auth, apiv2.accounts.update)
  router.get('/api/v2/tickets', apiv2Auth, apiv2.tickets.get)
  router.post('/api/v2/tickets', apiv2Auth, apiv2.tickets.create)
  router.get('/api/v2/tickets/:uid', apiv2Auth, apiv2.tickets.single)
  router.put('/api/v2/tickets/batch', apiv2Auth, apiv2.tickets.batchUpdate)
  router.put('/api/v2/tickets/:uid', apiv2Auth, apiv2.tickets.update)
  router.delete('/api/v2/tickets/:uid', apiv2Auth, apiv2.tickets.delete)
  router.post('/api/v2/groups', apiv2Auth, apiv2.groups.create)
  router.put('/api/v2/groups/:id', apiv2Auth, apiv2.groups.update)
  router.delete('/api/v2/groups/:id', apiv2Auth, apiv2.groups.delete)
  router.get('/api/v2/teams', apiv2Auth, apiv2.teams.get)
  router.post('/api/v2/teams', apiv2Auth, apiv2.teams.create)
  router.put('/api/v2/teams/:id', apiv2Auth, apiv2.teams.update)
  router.delete('/api/v2/teams/:id', apiv2Auth, apiv2.teams.delete)
  router.get('/api/v2/departments', apiv2Auth, apiv2.departments.get)
  router.post('/api/v2/departments', apiv2Auth, apiv2.departments.create)
  router.put('/api/v2/departments/:id', apiv2Auth, apiv2.departments.update)
  router.delete('/api/v2/departments/:id', apiv2Auth, apiv2.departments.delete)

Fixed code:
 *  Updated:    5/17/22 2:15 PM
  router.get('/api/v2/accounts', apiv2Auth, canUser('accounts:view'), apiv2.accounts.get)
  router.post('/api/v2/accounts', apiv2Auth, canUser('accounts:create'), apiv2.accounts.create)
  router.put('/api/v2/accounts/:username', canUser('accounts:update'), apiv2Auth, apiv2.accounts.update)
  router.get('/api/v2/tickets', apiv2Auth, canUser('tickets:view'), apiv2.tickets.get)
  router.post('/api/v2/tickets', apiv2Auth, canUser('tickets:create'), apiv2.tickets.create)
  router.get('/api/v2/tickets/:uid', apiv2Auth, canUser('tickets:view'), apiv2.tickets.single)
  router.put('/api/v2/tickets/batch', apiv2Auth, canUser('tickets:update'), apiv2.tickets.batchUpdate)
  router.put('/api/v2/tickets/:uid', apiv2Auth, canUser('tickets:update'), apiv2.tickets.update)
  router.delete('/api/v2/tickets/:uid', apiv2Auth, canUser('tickets:delete'), apiv2.tickets.delete)
  router.post('/api/v2/groups', apiv2Auth, canUser('groups:create'), apiv2.groups.create)
  router.put('/api/v2/groups/:id', apiv2Auth, canUser('groups:update'), apiv2.groups.update)
  router.delete('/api/v2/groups/:id', apiv2Auth, canUser('groups:delete'), apiv2.groups.delete)
  router.get('/api/v2/teams', apiv2Auth, canUser('teams:view'), apiv2.teams.get)
  router.post('/api/v2/teams', apiv2Auth, canUser('teams:create'), apiv2.teams.create)
  router.put('/api/v2/teams/:id', apiv2Auth, canUser('teams:update'), apiv2.teams.update)
  router.delete('/api/v2/teams/:id', apiv2Auth, canUser('teams:delete'), apiv2.teams.delete)
  router.get('/api/v2/departments', apiv2Auth, canUser('departments:view'), apiv2.departments.get)
  router.post('/api/v2/departments', apiv2Auth, canUser('departments:create'), apiv2.departments.create)
  router.put('/api/v2/departments/:id', apiv2Auth, canUser('departments:update'), apiv2.departments.update)
  router.delete('/api/v2/departments/:id', apiv2Auth, canUser('departments:delete'), apiv2.departments.delete)