Threats tagged 'ghsa-fj4q-cf3c-rrp2'

Trudesk versions up to and including 1.2.11 have a missing authentication vulnerability in debug routes when NODE_ENV is unset. This allows unauthenticated attackers to remotely invoke debug endpoints such as /debug/populatedb, which can delete all groups, tags, and tickets. Attackers can then log in using seeded accounts with a default password.