Role Manipulation Vulnerability in THEHIVE PROJECT Cortex by TheHive Project
CVE-2018-20226

7.2HIGH

Key Information:

Vendor

Thehive-project

Status
Cortex
Vendor
CVE Published:
21 December 2018

What is CVE-2018-20226?

A vulnerability exists in THEHIVE PROJECT Cortex versions before 2.1.3, where an organization administrator has the capability to add a super administrator. This occurs due to the inadequate implementation of the Role.toString method, which could potentially lead to unauthorized access and elevation of privileges within the application.

References

https://github.com/TheHive-Project/Cortex/commit/1aaf2182...
x_refsource_CONFIRM
https://github.com/TheHive-Project/Cortex/issues/158
x_refsource_CONFIRM
https://github.com/TheHive-Project/Cortex/blob/2.1.3/CHAN...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.