Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-ybmv-s2pm-ybe5 |
|---|
| Summary | People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted invitation request to promote any existing user (including users with no current domain access) to the Owner role. The exploit requires a single authenticated HTTP request and grants full domain ownership immediately, without any acceptance step from the target. This issue has been patched in version 1.25.0. |
|---|
| Aliases |
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
|
|---|
| References |
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
269 |
| name |
Improper Privilege Management |
| description |
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | 5.5 - 5.5 |
|---|
| Exploitability | null |
|---|
| Weighted_severity | null |
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-ybmv-s2pm-ybe5 |
|---|