Threats tagged 'ghsa-6w37-qc84-g44h'

A missing authorization vulnerability exists in Zr.Admin.NET between commits 1845017 and eb9228a in the TasksController.Get method. This flaw allows any authenticated user to access scheduled task details without requiring the monitor:job permission. Attackers can leverage an unprotected endpoint to enumerate task IDs and retrieve sensitive information such as job parameters, API URLs, cron expressions, and stored SQL statements. The vulnerability has a medium severity with a CVSS score of 4.3.