Threats tagged 'ghsa-xxr5-rv8h-2q24'

Jpom versions up to 2.11.12 have a cross-workspace authorization bypass vulnerability in the POST /node/ssh_command/batch endpoint. This flaw allows authenticated users with SSH command execution permission in one workspace to run commands on SSH hosts in other workspaces by supplying foreign template and node IDs, bypassing workspace filtering.