Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
| Link | Tags |
|---|---|
| https://huntr.dev/bounties/97ecf4b8-7eeb-4e39-917c-2660262ff9ba | patch third party advisory exploit |
| https://github.com/fossbilling/fossbilling/commit/b65a75fcf70feaf547d414672f78d7cbe8a98e7e | patch |