Lucene search
GoogleOSV:GHSA-8HW9-22V6-9JR9HistoryApr 19, 2021 - 3:14 p.m.
Any logged in user could edit any other logged in user.
2021-04-1915:14:33
Google
osv.dev
9
security patch
access control
user privilege
EPSS
0.001
Percentile
22.7%
Impact
Everyone who is running a12n-server.
A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change.
Patches
Patched in v0.18.2
Related
nvd
nvd
CVE-2021-29452
2021-04-16 22:15:14
cvelist
cvelist
CVE-2021-29452 Any logged in user could edit any other logged in user.
2021-04-16 21:35:15
osv
osv
CVE-2021-29452
2021-04-16 22:15:14
github
github
Any logged in user could edit any other logged in user.
2021-04-19 15:14:33
prion
prion
Authentication flaw
2021-04-16 22:15:00
veracode
veracode
Insecure Access Controls
2021-04-19 06:09:58
cve
cve
CVE-2021-29452
2021-04-16 22:15:14