Vulnerabilidades

Cerebrate before version 1.37 exposed credential material from self-registration requests. The self-registration workflow stored the registrant’s hashed password in the inbox message data payload. This payload was returned unredacted through inbox index and view responses, including HTML, JSON, and CSV outputs, and…

Cerebrate before version 1.37 allowed the id primary key field to be supplied through request input during CRUD edit operations and certain custom entity patching flows. In affected entities that did not explicitly mark id as inaccessible, an authenticated attacker could submit a crafted edit request containing the id…

Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler attempted to remove an attacker-supplied id from $params before normalizing the request through __massageInput(). Because the normalized $input could still contain an id field, a user able to reach an…

UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.

Cerebrate before 1.15 lacks the Secure attribute for the session cookie.

In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.

In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.

Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.

An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.

An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.

An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.

An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups.

An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.