OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator…
OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as the incident creator via POST /api/v1/incidents/{incident_id}/comment. Lower-privileged attackers can comment on incidents owned by users such as a Super User to impersonate them and corrupt the incident timeline and audit trail.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- OpsTree Solutions
- Product
- REMS
- CVSS v3.1
- 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- NVD status
- Received
Why it ranks 9 (Routine)
- CVSS v3.1 4.3 medium
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.