Description
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Oqtane Oqtane Framework
Default version status: unaffected
0 to ≤ 10.2.6affected
pkg:github/oqtane/oqtane.frameworkReferences
- https://hackmd.io/@hieuPenguinnn/oqtane-setting-site-cross-site-private-settings-idor ↗
- https://github.com/oqtane/oqtane.framework/blob/v10.2.6/Oqtane.Server/Controllers/SettingController.cs#L411-L516 ↗
- https://www.vulncheck.com/advisories/oqtane-framework-through-10.2.6-cross-site-settings-disclosure-via-setting-api ↗