GitHub Advisoryadvisory · PyPI

GHSA-67mg-gm8m-ph5r Improper Authorization in modoboa

CRITICAL Published 2023-04-21 Modified 2024-09-24 Official page ↗
Aliases
CVE-2023-2227
Ecosystem
PyPI
Packages
modoboa
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-285
Reviewed
2023-04-24

Affected packages

• PyPI modoboa: < 2.1.0 → fixed in 2.1.0

Description

In modoboa prior to 2.1.0, sending a GET request to the endpoint `/api/v2/parameters/core/` returns sensitive information without any authentication or authorization.

Related

Alias · CVE (1)

  • CVE-2023-2227 Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References