GitHub Advisoryadvisory · Hex

GHSA-mrq8-53r4-3j5m Permissive parameters and privilege escalation

MEDIUM Published 2022-02-10 Modified 2022-01-27 Official page ↗
Aliases
CVE-2018-20301
Ecosystem
Hex
Packages
coherence
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2022-01-27

Affected packages

• Hex coherence: < 0.5.2 → fixed in 0.5.2

Description

An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.

Related

Alias · CVE (1)

  • CVE-2018-20301 An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References