Description
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moghtech | komodo | ≤ 2.3.2 | — |
References
- GitHub Issue #1455 issue-tracking
- https://github.com/moghtech/komodo product
- Vulnerable code: update.rs technical-description
- Vulnerable code: mod.rs technical-description
- VulnCheck Advisory: Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check third-party-advisory