Threats tagged 'ghsa-9mr9-9xmv-5w3c'

Pig versions before 4.1.2 have a missing authorization vulnerability in the SysClientController component. This flaw allows authenticated users without client-management permissions to access OAuth2 client secrets via specific GET endpoints. Attackers can retrieve clientSecret values for default clients such as pig, app, and daemon or export the entire client table, enabling them to obtain tokens using these clients' grant types.