CyberRota Analysis
AI-GeneratedThe vulnerability in OliveTin allows users with execution permissions to access full log outputs from specific API endpoints without proper permission checks, potentially exposing sensitive information. This could lead to unauthorized information disclosure, impacting the confidentiality of the system. Organizations using versions prior to 3000.17.0 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user with exec permission but logs:false to read action output. This issue is fixed in version 3000.17.0.