Threats tagged 'ghsa-6j3h-rp73-6rvf'

The Telepresence Traffic Manager's Tunnel gRPC streaming endpoint accepts a client-supplied session ID without verifying ownership. An attacker who knows a valid active session ID can gain full network routing capabilities of that session. Session IDs are UUID4, making brute force difficult, but session IDs can be leaked or obtained internally. The vulnerability affects versions prior to 2.31.0 and is fixed in 2.31.0.