Vulnerability Description
Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result, for example, in creating a new admin user in the system which enables persistent access for the attacker as an administrator.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://cwe.mitre.org/data/definitions/285.html
- https://github.com/Peppermint-Lab/peppermint/issues/258
- https://github.com/Peppermint-Lab/peppermint/issues/258
FAQ
What is CVE-2024-31525?
CVE-2024-31525 is a vulnerability with a CVSS score of 7.2 (HIGH). Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authori...
How severe is CVE-2024-31525?
CVE-2024-31525 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-31525?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.