Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
toni_mueller roundup 'cgi/actions.py'权限许可和访问控制漏洞
Vulnerability Description
1.2.1以前的Roundup 1.2 ， 1.4 至 1.4.6， 其他可能的版本的cgi/actions.py中的EditCSVAction函数，不会很好地检查权限， 这会允许具有编辑或新建特权的远程认证用户修改任意项目，例如， 编辑全部的 查询，修改设置， 以及对用户添加规则。
CVSS Information
N/A
Vulnerability Type
N/A