Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API endpoints. This can lead to remote code execution by abusing the privileged API actions.
References
Link | Resource |
---|---|
https://github.com/bonitasoft/bonita-web | Product Third Party Advisory |
https://rhinosecuritylabs.com/application-security/cve-2022-25237-bonitasoft-authorization-bypass/ | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-05-27T16:48:43
Updated: 2022-05-27T16:48:43
Reserved: 2022-02-16T00:00:00
Link: CVE-2022-25237
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-06-02T14:15:40.153
Modified: 2023-08-08T14:22:24.967
Link: CVE-2022-25237
JSON object: View
Redhat Information
No data.
CWE