GHSA-ggf6-638m-vqmg
Netmaker vulnerable to Insufficient Granularity of Access Control
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/gravitl/netmaker | < 0.15.1 | 0.15.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Improper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.
In addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.
### Patches
This problem has been patched in v0.15.1. To apply:
1. docker-compose down
2. docker pull gravitl/netmaker:v0.15.1
3. docker-compose up -d
### For more information
If you have any questions or comments about this advisory:
Email us at [[email protected]](mailto:[email protected])
This vulnerability was brought to our attention by @tweidinger
References
External links from the advisory. They lead to third-party sites.