CVE-2020-26177

4.3MEDIUM

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied c

发布于: 12/18/2020更新于: 11/21/2024
在NVD查看在MITRE查看

描述

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibited server-side.

AI分析AI驱动

受影响产品

tangrobusiness_workflow

参考资料