A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XOpenbmb Xagent
APPOpenbmb1.0.0
Related vulnerabilities
A vulnerability was found in OpenBMB XAgent 1.0.0. It has been declared as critical. Affected by this vulnerab...
W OpenBMB XAgent 1.0.0 znaleziono lukę. Problem dotyczy funkcji FunctionHandler.handle_tool_call w pliku XAgen...
Odkryta została podatność w OpenBMB XAgent 1.0.0 w funkcjach ReplayServer.on_connect/ReplayServer.send_data pl...
W OpenBMB XAgent do wersji 1.0.0 odkryto krytyczną lukę bezpieczeństwa dotyczącą nieznanej funkcjonalności pli...