Description
vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
lenve vhr
Default version status: unaffected
0 to ≤ 03abbd35af24e55368ce4e09f4038dc2aba3ff5faffected
References
- https://github.com/lenve/vhr/issues/350 ↗
- https://github.com/lenve/vhr ↗
- https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-web/src/main/java/org/javaboy/vhr/controller/HrInfoController.java ↗
- https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-service/src/main/java/org/javaboy/vhr/service/HrService.java ↗
- https://www.vulncheck.com/advisories/vhr-missing-authorization-in-put-hr-pass-allows-cross-account-password-change ↗