VulnerabilityModified

CVE-2023-32749

Pydio Cells allows users by default to create so-called external users in order to share files with them.

HIGH 8.8EPSS 14.1%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 14.1%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 14.09% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-863
Affected: pydio/cells
Source: cve@mitre.org

References

http://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/May/18Exploit, Mailing List, Third Party Advisory
https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analysesThird Party Advisory
https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-003/-pydio-cells-unauthorised-role-assignmentsExploit, Third Party Advisory
http://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/May/18Exploit, Mailing List, Third Party Advisory
https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analysesThird Party Advisory
https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-003/-pydio-cells-unauthorised-role-assignmentsExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.