CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiprocket: from n/a through <= 2.0.8.
Explanation of Vulnerability in Simple Terms
Shiprocket versions up to 2.0.8 contain an authorization flaw that allows unauthenticated attackers to read sensitive data over the network. The vulnerability requires no user interaction and can be exploited remotely. Upgrade to version 2.0.9 or later to remediate.
What an attacker can do
Read sensitive data from Shiprocket without authentication.
Potential impact on your site
Confidential information may be exposed to unauthorized parties if running an affected version.
Conditions required to exploit
Network access to the Shiprocket instance; no authentication or user interaction required.
Key dates
External resources
