Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

hippo4j monitors system information leakage #1061

Open
laoquanshi opened this issue Feb 20, 2023 · 0 comments
Open

hippo4j monitors system information leakage #1061

laoquanshi opened this issue Feb 20, 2023 · 0 comments

Comments

@laoquanshi
Copy link

ConfigVerifyController for the Tenant Management module of hippo4j. There are information leakage vulnerabilities, unauthorized access vulnerabilities in authority promotion, The vulnerability is the result of check the thread pool modificationApplicationPage method does not to perform the current operation user identity and in the same Controller layer verifyConfigModification method to perform the current operation of the user for authentication , leading to any user can access/hippo4j/v1 / cs/configs/verify/query/application/page interface to retrieve information forms through the access/hippo4j/v1 / cs/configs/verify interface to modify the thread pool audit status
Influence version
hippo4j 1.4.3 (Nov 06, 2022)
image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant