Description
Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| diced | zipline | < 4.5.0 | 4.5.0 |
References
- GitHub Security Advisory (GHSA-fgwh-2pc5-wr73) vendor-advisory
- VulnCheck Advisory: Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints third-party-advisory