Description
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
moxi624 MoguBlog
Default version status: unaffected
0 to ≤ 6.2affected
pkg:github/moxi624/mogu_blog_v2References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C13_pictureSort_getByUid_bfla.py ↗
- https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_admin/src/main/java/com/moxi/mogublog/admin/restapi/PictureSortRestApi.java ↗
- https://gitee.com/moxi159753/mogu_blog_v2/releases ↗
- https://github.com/moxi624/mogu_blog_v2 ↗
- https://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authorization-on-the-admin-getpicturesortbyuid-endpoint ↗