Vendor
UTMStack
7 known vulnerabilities.
Products
7 results · Feed
-
Medium 6.5
UTMStack < 11.2.16 JPQL Injection via searchPropertyValues
UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues(), which builds a JPQL query with String.format() and executes it via em…
-
High 7.7
UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed v…
-
Medium 5.3
UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can su…
-
Critical 9.8
UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalA…
-
Critical 9.9
UTMStack < 11.2.16 Missing Authorization via Command WebSocket
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supp…
-
Medium 5.0
UTMStack < 11.2.16 SSRF via IdentityProviderService
UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl() that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a mal…
-
High 8.8
UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a …