Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dev Blog v1.0 - ATO
Vulnerability Description
Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by knowing their username.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability Type
通过用户控制密钥绕过授权机制
Vulnerability Title
DevBlog 安全漏洞
Vulnerability Description
DevBlog是Arman Idrisi个人开发者的一个使用 Node.js (Express) 和 MongoDB 开发的博客项目。 DevBlog v1.0版本存在安全漏洞，该漏洞源于允许通过用户cookie 进行帐户接管，攻击者只需知道用户名即可访问任何用户的会话。
CVSS Information
N/A
Vulnerability Type
N/A