InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NInventree Project Inventree
APPInventree Project≤ 1.2.6
Powiązane podatności
InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenT...
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associa...
InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for ...
Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0....