Threats tagged 'ghsa-xc4c-5vw7-m8p2'

Eclipse Kura versions 5.4.0 through 5.6.2 contain a vulnerability in the Identity REST APIs where permission checks are not properly enforced. An authenticated user with the rest.identity permission can escalate privileges by assigning any permission, including administrative rights, to themselves or others. They can also change passwords or delete identities with higher privileges, potentially locking out legitimate administrators. This vulnerability is resolved in version 5.6.3.