CyberRota Analysis
AI-GeneratedMWDB Core versions from 2.0.0 to 2.18.9 are vulnerable due to a missing authorization flaw in the deprecated config and blob upload endpoints, which allows authenticated users to bypass capability checks and upload unauthorized config and text blob objects. The impact is restricted to the addition of new configurations and blobs, potentially compromising system integrity. Organizations using affected versions should prioritize upgrading to version 2.19.0 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user without the adding_configs or adding_blobs capabilities to upload config and text blob objects to the system. The impact is limited to adding new config and blob objects. This issue has been fixed in version 2.19.0