An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1nZ2Y2LTYzOG0tdnFtZ84AAuz0
Netmaker vulnerable to Insufficient Granularity of Access Control
Improper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.
In addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.
This problem has been patched in v0.15.1. To apply:
- docker-compose down
- docker pull gravitl/netmaker:v0.15.1
- docker-compose up -d
For more information
If you have any questions or comments about this advisory:
Email us at [email protected] This vulnerability was brought to our attention by @tweidingerPermalink: https://github.com/advisories/GHSA-ggf6-638m-vqmg
Source: GitHub Advisory Database
Published: about 1 year ago
Updated: 3 months ago
CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-ggf6-638m-vqmg, CVE-2022-36110
Fixed in: 0.15.1