Description
Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| givanz | Vvveb | ≤ 1.0.8.6 | — |
References
- GitHub Security Advisory (GHSA-387r-2vfq-vrmf) vendor-advisory
- VulnCheck Advisory: Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait third-party-advisory