-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the lack of server-side authorization when serving the OneUptime Admin Dashboard. The system improperly trusted a client-side parameter, isMasterAdmin, which could be manipulated by a user during the login process. The fixing commit 3e72b2a9a4f50f98cf1f6cf13fa3e405715bb370 reveals that the init function in AdminDashboard/Serve.ts was responsible for setting up the admin dashboard. Prior to the patch, this function initialized the application without any server-side checks to confirm if the user was a master admin. The patch rectifies this by introducing a new function, ensureMasterAdminAccess, which validates the user's role by decoding their JSON Web Token (JWT) on the server. This check is now hooked into the application's initialization process within the init function. Therefore, the init function is identified as the vulnerable function because it was the entry point for serving the admin dashboard without proper access control.
initAdminDashboard/Serve.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @oneuptime/common | npm | < 8.0.5567 | 8.0.5567 |
JavaScriptJavaScriptOngoing coverage of React2Shell