Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. (In addition, such users can be granted several admin permissions via the Roles parameter.)
References
| Link | Resource |
|---|---|
| https://charonv.net/Pydio-Broken-Access-Control/ | Third Party Advisory |
| https://github.com/pydio/cells/releases/tag/v2.2.12 | Release Notes Third Party Advisory |
| https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212 | Product Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Jul 2022, 17:42
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
07 Oct 2021, 02:58
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:pydio:cells:2.2.9:*:*:*:-:*:*:* cpe:2.3:a:pydio:cells:2.2.9:*:*:*:enterprise:*:*:* |
|
| CWE | CWE-863 | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
| References | (MISC) https://github.com/pydio/cells/releases/tag/v2.2.12 - Release Notes, Third Party Advisory | |
| References | (MISC) https://pydio.com/fr/community/releases/pydio-cells/pydio-cells-enterprise-2212 - Product, Vendor Advisory | |
| References | (MISC) https://charonv.net/Pydio-Broken-Access-Control/ - Third Party Advisory |
30 Sep 2021, 19:43
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-09-30 19:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-41325
Mitre link : CVE-2021-41325
CVE.ORG link : CVE-2021-41325
JSON object : View
Products Affected
pydio
- cells
CWE