Roundup Improper Access Control
Moderate severity
GitHub Reviewed
Published
May 2, 2022
to the GitHub Advisory Database
•
Updated Apr 10, 2024
Package
Affected versions
>= 1.2, < 1.2.1
>= 1.4, <= 1.4.6
Patched versions
1.2.1
1.4.7
Description
Published by the National Vulnerability Database
Aug 11, 2009
Published to the GitHub Advisory Database
May 2, 2022
Reviewed
Apr 1, 2024
Last updated
Apr 10, 2024
Credits
-
anonymous4ACL24 Analyst
The EditCSVAction function in
cgi/actions.pyin Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.References