Threats tagged 'ghsa-9hfj-jg3v-c22g'

The Rapid7 Metasploit msf-ws component has a missing authentication vulnerability in its REST API. Specifically, when the users table is empty, the POST /api/v1/users endpoint allows unauthenticated creation of the first administrator user due to a bootstrap exemption. This flaw was fixed in version 6.5.9.