Threat database

Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed

IKUS Rdiffweb versions before 2.10.5 contain an improper authorization vulnerability that allows attackers with any valid or stolen access token to impersonate other users. The API fails to enforce proper binding between the authenticated user and the targeted user or tenant, enabling crafted requests to access or modify data belonging to other users and potentially perform privileged actions. This flaw may also allow cross-tenant data access. The issue is fixed in version 2.10.6.

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6.