Description
A vulnerability was detected in WeiYe-Jing datax-web up to 2.1.2. This impacts the function remove/update/pause/start/triggerJob of the component Job Handler. Performing manipulation results in improper access controls. The attack may be initiated remotely. The exploit is now public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WeiYe-Jing | datax-web | 2.1.0, 2.1.1, 2.1.2 | — |
References
- VDB-332584 | WeiYe-Jing datax-web Job triggerJob access control vdb-entry technical-description
- VDB-332584 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #687604 | WeiYe-Jing DataX-Web <= 2.1.2 Broken Access Control / Horizontal Privilege Escalation third-party-advisory
- https://github.com/Xzzz111/exps/blob/main/archives/datax-web-broken-access-control-1/report.md exploit