Description
vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
lenve vhr
Default version status: unaffected
0 to ≤ 03abbd35af24e55368ce4e09f4038dc2aba3ff5faffected
References
- https://github.com/lenve/vhr/issues/349 ↗
- https://github.com/lenve/vhr ↗
- https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-web/src/main/java/org/javaboy/vhr/controller/HrInfoController.java ↗
- https://github.com/lenve/vhr/blob/03abbd35af24e55368ce4e09f4038dc2aba3ff5f/vhr/vhrserver/vhr-mapper/src/main/java/org/javaboy/vhr/mapper/HrMapper.xml ↗
- https://www.vulncheck.com/advisories/vhr-missing-authorization-in-put-hr-info-allows-arbitrary-profile-overwrite ↗