Threats tagged 'ghsa-ffjc-v396-6wqr'

A vulnerability in Zenitel Connect firmware versions before 1.11.0 allows local attackers to execute database operations as the PostgreSQL superuser. The pREST database REST API signs and verifies JWTs using the platform CA private key, which is stored on a shared data volume accessible between containers. Attackers who can read this private key can forge JWTs with the sub claim set to 'postgres', enabling them to perform privileged database actions, including reading sensitive data such as the master encryption key and password hashes.