Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject…
高危 CVSS 7.5
摘要
Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs carries [AllowAnonymous] and therefore opts out of that policy. PreviewReport loads the Project row named by the id path segment, loads the linked Organisation through the project's ClientId, and renders b…
中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。
深度研判
该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。
数据来源
- NVD DATABASE
原始链接
- https://github.com/reconmap/reconmap
- https://github.com/reconmap/reconmap/blob/56ca3748343a50c98185d53827172d8f13a6ad0f/apps/api/app/Controllers/ReportsController.cs
- https://github.com/reconmap/reconmap/blob/56ca3748343a50c98185d53827172d8f13a6ad0f/apps/api/app/Program.cs
- https://github.com/reconmap/reconmap/commit/2b2eb0cf0aa95726b4edd0045f86d2dcdb8de34d
- https://github.com/reconmap/reconmap/security/advisories/GHSA-mhrh-jfmr-8mmw
- https://www.vulncheck.com/advisories/reconmap-report-preview-endpoint-is-marked-allowanonymous-exposing-every-project-and-client-organisation-without-authentication
时间线
- nvd_ingest NVD