Vulnerabilidades

La imagen de Docker de ownCloud Server hasta 10.11 contiene una configuración incorrecta que inutiliza la configuración de Trusted_domains. Se podría abusar de esto para falsificar la URL en mensajes de correo electrónico de restablecimiento de contraseña.

*** Pendiente de traducción *** Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option. This issue has been patched in versions 5.3.3 and 4.10.20. There are no known workarounds.

dotCMS anterior a 22.06 permite a atacantes remotos omitir el control de acceso previsto y obtener información confidencial utilizando un punto y coma en una URL para introducir un parámetro de matriz. (Esto también se corrigió en 5.3.8.12, 21.06.9 y 22.03.2 para usuarios de LTS). Algunos frameworks de aplicaciones Java, incluidos los utilizados por Spring o Tomcat, permiten el uso de parámetros matriciales: estos son parámetros URI separados por punto y coma. Mediante la colocación precisa de punto y coma en un URI, es posible explotar esta característica para evitar la prevención XSS basada en rutas de dotCMS (como los filtros "requerir inicio de sesión") y, en consecuencia, acceder a recursos restringidos. Por ejemplo, un atacante podría colocar un punto y coma inmediatamente antes del carácter / que separa los elementos de una ruta del sistema de archivos. Esto podría revelar contenido del archivo que normalmente solo es visible para los usuarios que han iniciado sesión. Este problema se puede encadenar con otro código de explotación para lograr ataques XSS contra dotCMS.

*** Pendiente de traducción *** ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically administrators and editors. This issue has been patched in versions 2.3.12, and 1.0.13 on the 1.X branch. Users unable to upgrade can remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.

*** Pendiente de traducción *** Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is possible to partially bypass the `fs` scope definition. It is not possible to traverse into arbitrary paths, as the issue is limited to neighboring files and sub folders of already allowed paths. The impact differs on Windows, MacOS and Linux due to different specifications of valid path characters. This bypass depends on the file picker dialog or dragged files, as user selected paths are automatically added to the allow list at runtime. A successful bypass requires the user to select a pre-existing malicious file or directory during the file picker dialog and an adversary controlled logic to access these files. The issue has been patched in versions 1.0.7, 1.1.2 and 1.2.0. As a workaround, disable the dialog and fileDropEnabled component inside the tauri.conf.json.

Se descubrió un problema en BMC Remedy antes del 22.1. El reenvío de incidentes basado en correo electrónico permite a los usuarios remotos autenticados inyectar HTML (como un payload SSRF) en el registro de actividad colocándolo en el campo Para:. Esto afecta la representación que se produce al hacer click en el campo "number of recipients". NOTA: la posición del proveedor es que "no se demuestra ningún impacto real".

Se descubrió que AyaCMS v3.1.2 contenía una vulnerabilidad de carga de archivos arbitraria a través del componente /admin/fst_upload.inc.php. Esta vulnerabilidad permite a los atacantes ejecutar código arbitrario a través de un archivo PHP manipulado.

Unmarshal puede entrar en pánico ante algunas entradas, lo que posiblemente permita ataques de Denegación de Servicio (DoS).

*** Pendiente de traducción *** Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this configuration, the virtual memory mapping for WebAssembly memories did not meet the compiler-required configuration requirements for safely executing WebAssembly modules. Wasmtime's default settings require virtual memory page faults to indicate that wasm reads/writes are out-of-bounds, but the pooling allocator's configuration would not create an appropriate virtual memory mapping for this meaning out of bounds reads/writes can successfully read/write memory unrelated to the wasm sandbox within range of the base address of the memory mapping created by the pooling allocator. This bug is not applicable with the default settings of the `wasmtime` crate. This bug can only be triggered by setting `InstanceLimits::memory_pages` to zero. This is expected to be a very rare configuration since this means that wasm modules cannot allocate any pages of linear memory. All wasm modules produced by all current toolchains are highly likely to use linear memory, so it's expected to be unlikely that this configuration is set to zero by any production embedding of Wasmtime. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by increasing the `memory_pages` allotment when configuring the pooling allocator to a value greater than zero. If an embedding wishes to still prevent memory from actually being used then the `Store::limiter` method can be used to dynamically disallow growth of memory beyond 0 bytes large. Note that the default `memory_pages` value is greater than zero.

*** Pendiente de traducción *** Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.

Wasmtime es una ejecución independiente de WebAssembly. Antes de la versión 2.0.2, había un error en la implementación de Wasmtime de su asignador de instancias de pooling donde, cuando se reutiliza una memoria lineal para otra instancia, la instantánea de la pila inicial de la instancia anterior puede ser visible, erróneamente, para la siguiente instancia. Este error ha sido corregido y los usuarios deben actualizar a Wasmtime 2.0.2. Otras mitigaciones incluyen deshabilitar el asignador de instancias de pooling y deshabilitar la "memory-init-cow".

*** Pendiente de traducción *** Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.