Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tcnE4LTUzcjQtM2o1bc0m4g

Permissive parameters and privilege escalation

An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.

Permalink: https://github.com/advisories/GHSA-mrq8-53r4-3j5m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcnE4LTUzcjQtM2o1bc0m4g
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: over 1 year ago

CVSS Score: 6.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Identifiers: GHSA-mrq8-53r4-3j5m, CVE-2018-20301
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-20301
• https://github.com/smpallen99/coherence/issues/270
• https://github.com/advisories/GHSA-mrq8-53r4-3j5m

Repository: https://github.com/smpallen99/coherence
Blast Radius: 10.5

Affected Packages