Netmaker IDOR Vulnerability Allows User to Update Other User's Password
CVE-2023-32078
7.5HIGH
What is CVE-2023-32078?
Netmaker, a platform for creating networks using WireGuard, contains an Insecure Direct Object Reference vulnerability that allows unauthorized users to update another user's password. This flaw exists in the user update function in versions prior to 0.17.1 and 0.18.6. By supplying a different user's username, an attacker could exploit this vulnerability to change that user's password. Users operating on versions 0.17.1 should run specific commands to pull the patched image, while those on versions 0.18.0 to 0.18.5 are encouraged to upgrade to 0.18.6 or above to mitigate the risk. A workaround is also available for those using version 0.17.1.
Affected Version(s)
netmaker < 0.17.1 < 0.17.1
netmaker >= 0.18.0, < 0.18.6 < 0.18.0, 0.18.6