CVE-2018-20345
21.12.2018, 19:29
Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=<username>" query filter parameters. Enterprise editions with RBAC enabled are not affected.Enginsight
| Vendor | Product | Version |
|---|---|---|
| stackstorm | stackstorm | 𝑥 < 2.9.2 |
| stackstorm | stackstorm | 2.10.0 ≤ 𝑥 < 2.10.1 |
𝑥
= Vulnerable software versions