漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources
Vulnerability Description
Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available.
CVSS Information
N/A
Vulnerability Type
不充分权限或特权的处理不恰当
Vulnerability Title
Appsmith 安全漏洞
Vulnerability Description
Appsmith是Appsmith开源的一个用于构建、部署和维护内部应用程序的开源平台。 Appsmith 1.51之前版本存在安全漏洞，该漏洞源于App Viewer能够获取工作区中的数据源列表，可能导致信息泄露。
CVSS Information
N/A
Vulnerability Type
N/A