Threats tagged 'ghsa-7jg5-pchw-4x54'

ChronoFrame versions up to 1.0.0 have a missing authentication vulnerability in the server/api/wizard/ handlers. This flaw allows unauthenticated attackers to reconfigure instances by sending POST requests to /api/wizard/storage, enabling them to redirect uploads and storage reads to attacker-controlled S3 or OpenList providers and overwrite site and map settings. The vulnerability has a high severity with a CVSS score of 8.8. A patch is available, and since this is a cloud service, the vendor manages remediation.