Threats affecting pkg:maven/org.eclipse.kura/kura

Eclipse Kura versions 5.0.0 through 5.6.2 have a vulnerability in the Web Console where each request to certain authentication endpoints allocates a new HTTP session without limits. This allows an unauthenticated attacker to cause unbounded session allocation, exhausting JVM heap memory and crashing the Kura process.

Eclipse Kura versions 5.4.0 through 5.6.2 contain an improper privilege management vulnerability in the Identity REST APIs. Authenticated users with the rest.identity permission, but without administrative rights, can escalate their privileges to full administrator by assigning permissions to themselves or others, changing passwords, deleting identities, and modifying permissions. This flaw allows attackers to lock out legitimate administrators. The issue is resolved in version 5.6.3.

Eclipse Kura versions 5.0.0 through 5.6.2 contain a vulnerability in the Wire Graph update functionality of the Web UI and the Wire Service REST API v1. The flaw allows an authenticated user with limited wires management permissions to modify configurations of components outside the Wire Graph, including security-relevant components, by relying on untrusted factory identifiers in requests. This can lead to escalation to full administrative privileges and potential device disruption. The issue requires at least one Driver installed on the device and is fixed in version 5.6.3.