Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-vp66-1yq4-5qbm |
|---|
| Summary | OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption
In `openclaw` MS Teams file-consent flow, pending uploads were authorized by `uploadId` alone. `fileConsent/invoke` did not verify the invoke conversation against the conversation that created the pending upload. |
|---|
| Aliases |
| 0 |
| alias |
GHSA-j26j-7qc4-3mrf |
|
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
|
|---|
| References |
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
639 |
| name |
Authorization Bypass Through User-Controlled Key |
| description |
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
|
| 1 |
| cwe_id |
862 |
| name |
Missing Authorization |
| description |
The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
|
| 2 |
| cwe_id |
937 |
| name |
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013. |
|
| 3 |
| cwe_id |
1035 |
| name |
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| description |
Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | null |
|---|
| Exploitability | null |
|---|
| Weighted_severity | null |
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-vp66-1yq4-5qbm |
|---|