CVE-2023-32749

Katalog CVE

CVSS 8.8 · High EPSS 14,1%

Kerentanan Incorrect Authorization pada pydio cells. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted.

Rincian

Terbit di NVD

8 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

14,1% peluang dieksploitasi; lebih tinggi dari 96,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2023/May/18 exploit · mailing list · advisory pihak ketiga
• https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses advisory pihak ketiga
• https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-003/-pydio-cells-unauthorised-role-assignments exploit · advisory pihak ketiga