Threats tagged 'ghsa-92r3-p8c2-3fpx'

A privilege escalation vulnerability exists in Eclipse hawkBit Direct Device Integration (DDI) Controller versions 1.0.3 and earlier. Authenticated devices within a tenant can bypass assignment restrictions and download any firmware artifact assigned to that tenant, rather than only those explicitly assigned to them. This flaw is due to improper object-level authorization validation. The vulnerability has moderate severity with low confidentiality impact, as access is limited to the tenant scope and firmware binaries typically do not contain sensitive data. The issue is fixed in version 1.0.4.