TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user (including admin), or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an authenticated ...
from Google Alert - vulnerability http://ift.tt/2k5mnrA
via IFTTT
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment