GitHub Advisoryadvisory · NuGet

GHSA-2hr5-cvwp-jr5w Oqtane Framework Insecure Direct Object Reference vulnerability

LOW Published 2024-12-20 Modified 2024-12-20 Official page ↗
Aliases
CVE-2024-55186
Ecosystem
NuGet
Packages
Oqtane.Framework, Oqtane.Client, Oqtane.Server, Oqtane.Shared
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-639, CWE-863
Reviewed
2024-12-20

Affected packages

• NuGet Oqtane.Framework: <= 6.0.0 (no fix yet) • NuGet Oqtane.Client: <= 6.0.0 (no fix yet) • NuGet Oqtane.Server: <= 6.0.0 (no fix yet) • NuGet Oqtane.Shared: <= 6.0.0 (no fix yet)

Description

An IDOR (Insecure Direct Object Reference) vulnerability exists in Oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users.

Related

Alias · CVE (1)

  • CVE-2024-55186 An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox… vulnerability

Weakness · CWE (2)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-863 Incorrect Authorization weakness

References