CVE-2023-32749

HIGH Year: 2023
CVSS v3 Score
8.8
High
Weakness Type
CWE-863
View all →

Vulnerability Description

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted.

Related Vulnerabilities

CVE-2010-3782

HIGH
CVSS:8.8(High)

obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation.

CWE-8632010

CVE-2016-4572

HIGH
CVSS:8.8(High)

In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.

CWE-8632016

CVE-2017-0910

HIGH
CVSS:8.8(High)

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.

CWE-8632017

CVE-2017-10805

HIGH
CVSS:8.8(High)

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAu...

CWE-8632017

CVE-2017-15695

HIGH
CVSS:8.8(High)

When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allo...

CWE-8632017

CVE-2017-2305

HIGH
CVSS:8.8(High)

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowi...

CWE-8632017