Eclipse Mnestix Browser missing authorization lets unauthenticated users change settings
Anyone without a login can change the admin settings.
Summary
Missing server-side authorization in the Eclipse Mnestix Browser admin server actions lets an unauthenticated attacker change Infrastructure settings or call the connected AAS Generator backend. Versions 1.2.0 up to but excluding 2.3.0 are affected.
What to do
Check that you run a version newer than 2.3.0 and read the vendor's advisory. Versions 1.2.0 up to but excluding 2.3.0 are affected.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen