Threats tagged 'ghsa-r5fr-g49p-c3pg'

Netcccyun dnsmgr versions from 2.18 up to but not including 2.22 contain a missing authorization vulnerability in the POST /cloudflare/get_domain_default_line endpoint. This flaw allows restricted sub-users or single-domain logins to enumerate domain IDs by iterating the domain_id parameter and access DNS line lists and default lines for domains outside their permissions.