OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another…
OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- OpsTree Solutions
- Product
- REMS
- CVSS v3.1
- 4.3 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- NVD status
- Received
Why it ranks 9 (Routine)
- CVSS v3.1 4.3 medium
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.