Threats tagged 'ghsa-2qmp-cjw7-vvxj'

blueprintUE Self-Hosted Edition versions prior to 4.3.7 have an insecure default Docker Compose configuration that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes and exposes the MariaDB database on port 3306. This allows unauthenticated attackers with network access to the Docker host's port 3306 to log in as root without a password, enabling them to read, modify, or delete all user accounts, blueprints, and databases.