Chartbrew web app multiple flaws expose accounts and data
Attackers can enter other people's accounts or steal chart data in this chart tool!
Summary
Several flaws in the Chartbrew web app let attackers enter other users' accounts, read private chart data, or delete server files. They apply only under some conditions, such as installs that keep the default CB_SECRET.
Affected when
- CB_SECRET is default, known or weak (stock source or Docker Compose install)
What to do
Update to 5.2.3.
Products and platforms
CVE IDs
Sources
Times
First published
First seen