POJIA破甲
地图 / Allow authenticated users can edit, trash,and add new in BuddyPress Emails function

Allow authenticated users can edit, trash,and add new in BuddyPress Emails function

访问控制 / 权限提升 / #833782

厂商
WordPress
严重程度
低危
赏金
—
弱点
权限提升
研究员
@hoangkien1020
披露日期
2020-05-22
资产
BuddyPress Core
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(790 字符中的一小部分)
Allow author can edit, trash,and add new your posts in BuddyPress Emails function And editor can edit,trash, add new any posts in BuddyPress Emails default. Steps To Reproduce:

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 WordPress 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @hoangkien1020 · 版权归作者与 WordPress 所有

同类报告

Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationShopify · 2020-09-15Shopify Stocky App OAuth MisconfigurationShopify · 2019-12-11Able to Become Admin for Any LINE Official AccountLY Corporation · 2020-03-25Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requestsGitLab · 2019-11-27 · $12,000Read-only application can publish/delete fleetsX / xAI · 2021-01-04Subdomain takeover of datacafe-cert.starbucks.comStarbucks · 2019-08-28