Unauthorized viewing by workspace members(CVE-2024-32467)

Moderate

fit2-zhao published GHSA-7499-q88f-mxqp

Apr 25, 2024

Package

No package listed

Affected versions

<= v2.10.13-lts

Patched versions

v2.10.14-lts

Description

author

L1NG
383417532@qq.com

Summary

没有空间权限的成员，可以越权查看其他工作空间的成员信息
Members without space permissions can view member information from other workspaces beyond their authority

Detail

/product/user/special/ws/member/list/all接口缺少了权限检查

PoC

1.账号1加入空间1
2.账号2加入空间2
3.账号2点击产品列表出现查看空间2的成员信息数据包时候将空间2的id替换成空间1的id
4.可以查看到空间1的成员信息

Account 1 Joins Space 1
Account 2 Join Space 2
When Account 2 clicks on the product list to view the member information data package of Space 2, replace the ID of Space 2 with the ID of Space 1
You can view the member information of space 1

Severity

Moderate

5.7

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L