CyberRota Analysis
AI-GeneratedThe `nl.nl-portal:taak` package versions 1.5.0 to 3.0.0 in the NL Portal Backend Libraries are vulnerable due to improper ownership verification in the `submitTaakV2` GraphQL mutation, enabling authenticated users to access, modify, and complete tasks belonging to other users. This vulnerability poses a significant risk of data exposure and unauthorized actions within Dutch government portals. Organizations utilizing these libraries, particularly those in the public sector, should prioritize upgrading to version 3.0.1 or implementing the suggested workarounds to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks