7 results · Feed
-
High 8.3
Path traversal in AshAdmin file uploads via unsanitized client filename
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the …
-
Low 2.3
AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF)…
-
Low 2.1
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted…
-
Low 2.0
Query-parameter injection in AshAdmin row-action links via unencoded string primary keys
Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by ra…
-
High 8.4
Stored XSS in AshAdmin relationship typeahead via unescaped label_field content
Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.…
-
High 8.3
AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers interned atoms from unvalidated cl…
-
High 8.3
AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript …