Threats Tagged 'cwe-915'

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot `state_json` embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned `state_json` in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip `is_admin` to `True`, or change `account_id` / `balance` — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern). This issue is fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path. As a workaround, do not enable state snapshots; do not hold authorization/ownership state in public view attributes.

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.mixins.model_binding.ModelBindingMixin` provides a default `update_model` event handler and is part of the LiveView base MRO, so every LiveView exposes it. It `setattr`s a view attribute whose name is client-supplied (`field`), gated only by: reject `_`-prefixed names; reject a 14-entry denylist of framework internals (`FORBIDDEN_MODEL_FIELDS`); optional `allowed_model_fields` which defaults to None = allow all; and `hasattr` existence. As a result, a client can set any public, existing view attribute — not just the fields actually bound with `dj-model=` in the rendered template. The denylist covers framework plumbing but nothing about developer business/authz state, and the allowlist is opt-in (off by default). A developer who binds one `dj-model="search"` input and also keeps `self.account_id` / `self.is_admin` / `self.total_price` as view state does not realize a client can set ALL of them via `{type:event, event:"update_model", params:{field, value}}` over the WebSocket. Type coercion matches the target attribute's type (so `"true"` -> bool True), aiding the attacker. This issue is fixed in djust 1.0.7. As a workaround, set `allowed_model_fields` explicitly on every view using dj-model (or subclassing LiveView) to the minimal list of bindable fields; do not keep authorization/ownership state in public view attributes that share the view with dj-model bindings.

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is __proto__, temp[parent] can resolve to Object.prototype, and initPush() can write attacker-controlled data to the global children prototype property while existing prototype methods remain intact. Any application that passes attacker-influenced flat records to convert() can therefore expose unrelated objects to polluted inherited state, causing application-logic corruption or denial of service and potentially enabling greater impact when a downstream prototype-pollution gadget is present. The constructor and prototype strings are also unsafe inherited-key values in the same lookup design. This issue is fixed in version 1.1.2.

A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

CVE-2026-78038 is a medium severity vulnerability in ash-project's ash_oban component that allows improper modification of dynamically-determined object attributes. The flaw arises because user input passed to the :args option of AshOban.build_trigger/3 can override trusted job arguments due to JSON key handling, enabling an attacker to retarget update or destroy triggers at other records, potentially crossing tenant boundaries. This breaks authorization and tenant isolation assumptions. The vulnerability affects versions from 0.2.5 up to but not including 0.8.14.

CVE-2026-59284 is a medium severity vulnerability in Spring Cloud Commons affecting versions 3.1.10 and earlier through 5.0.2. It involves the lack of an allow list for property keys when the writable /actuator/env endpoint is enabled, potentially allowing improper modification of dynamically-determined object attributes. The vulnerability is classified under CWE-915. No official patch or remediation guidance is currently confirmed.

CVE-2026-47849 is a high severity vulnerability in Spring Data REST that allows mutation of identifier (@Id) and version (@Version) properties via JSON Patch requests. This improper control of dynamically-determined object attributes can lead to integrity issues. The vulnerability affects multiple versions of Spring Data REST including 3.7.20 and earlier, 4.0.0 through 4.4.15, 4.5.0 through 4.5.12, 5.0.0 through 5.0.6, and 5.1.0. There is no confirmed patch or official remediation available at this time.

CVE-2026-47850 is a medium severity vulnerability in Spring Data REST where the persisted version (@Version) property of an aggregate root is not preserved when handling HTTP PUT requests against immutable target types. This issue affects multiple versions of Spring Data REST including 3.7.20 and earlier, 4.0.0 through 4.4.15, 4.5.0 through 4.5.12, 5.0.0 through 5.0.6, and 5.1.0. The vulnerability relates to improper control of dynamically-determined object attributes, classified under CWE-915. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

CVE-2026-77144 is a vulnerability in the TYPO3 Extension "Events 2" that allows a user with frontend event management access to create events attributed to organizers other than themselves. This occurs because the plugin assigns a new event to the submitting user's organizer record only if no organizer is specified in the request, and the permission check only verifies that the user has any organizer role, not that they own the organizer record. The vulnerability has a high severity with a CVSS score of 7.1.