Description
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fsinfuhh | Bitpoll | ≤ 0.11.0 | — |
References
- GitHub Issue #206 issue-tracking
- https://github.com/fsinfuhh/Bitpoll product
- https://github.com/fsinfuhh/Bitpoll/blob/0.11.0/bitpoll/poll/views.py#L994 technical-description
- https://github.com/fsinfuhh/Bitpoll/commit/71013d36a4d587e672eba225d94f7b94cd412ef9 patch
- VulnCheck Advisory: Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookups third-party-advisory