attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is low; integrity impact is high; availability impact is high.
Affected products
absmach magistrala
Classified as
CWE-639 (Authorization Bypass Through User-Controlled Key)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
absmach
magistrala
Subsystems
General OT
Sectors
Multiple
What to Know
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids. (NVD)
What to Do
Monitor absmach's web page for any future patch releases.