CVE-2023-32078

Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user update function. By specifying another user's username, it was possible to update the other user's password. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*
cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*

History

31 Aug 2023, 17:59

Type Values Removed Values Added
References (MISC) https://github.com/gravitl/netmaker/commit/b3be57c65bf0bbfab43b66853c8e3637a43e2839 - (MISC) https://github.com/gravitl/netmaker/commit/b3be57c65bf0bbfab43b66853c8e3637a43e2839 - Patch
References (MISC) https://github.com/gravitl/netmaker/pull/2158 - (MISC) https://github.com/gravitl/netmaker/pull/2158 - Patch
References (MISC) https://github.com/gravitl/netmaker/security/advisories/GHSA-256m-j5qw-38f4 - (MISC) https://github.com/gravitl/netmaker/security/advisories/GHSA-256m-j5qw-38f4 - Vendor Advisory
CPE cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
First Time Gravitl
Gravitl netmaker

24 Aug 2023, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-08-24 22:15

Updated : 2024-02-28 20:33


NVD link : CVE-2023-32078

Mitre link : CVE-2023-32078

CVE.ORG link : CVE-2023-32078


JSON object : View

Products Affected

gravitl

  • netmaker
CWE
CWE-639

Authorization Bypass Through User-Controlled Key