Skip to content
OpenAdvisories

Package · PyPI

kinto-attachment

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 8.6
    CVE-2024-1314

    Kinto Attachment's attachments can be replaced on read-only records

    ### Impact The attachment file of an existing record can be replaced if the user has `"read"` permission on one of the parent (collection or bucket). And if the `"read"` permission is given to `"system.Everyone"` on one of the parent, then the attachment can …

    kinto-attachment PyPI