CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Monthly
Remote unauthenticated attackers can manipulate object attributes through the Apache Allura REST API in versions up to and including 1.21.0, because the API's object-binding logic (CWE-915, mass assignment) fails to whitelist which client-supplied fields may be written. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, giving a base score of 9.1 with high confidentiality and integrity impact and no availability impact, and no user interaction or credentials are required per that vector, though the practical exposure is limited by the small, largely self-hosted population of Allura instances and whether the affected write endpoints are reachable or gated behind authentication in a given deployment. Exploitation does not appear to be widespread: EPSS is only 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis; the vendor-released fix is Apache Allura 1.22.0.
Authenticated mass assignment in jshERP through 3.6 lets any user holding a valid low-privilege account overwrite protected fields on a user record - including tenant_id and password - by submitting a crafted PUT /user/update body, enabling silent cross-tenant identity switching on the next login or takeover of other accounts via password-hash overwrite. The vulnerable code path is the default UserController update handler and exploitation requires only an authenticated session (CVSS v3.1 base 8.7, PR:L, no user interaction or non-default configuration). Publicly available exploit code exists and no confirmed active exploitation (CISA KEV) has been reported at time of analysis.
Privilege escalation in GoatCounter through 2.7.0 lets an authenticated user - even one holding only read-only access - promote their own account to superuser by sending a form-encoded POST to /user/pref containing protected fields such as user.access[all]=* and user.email_verified=true, which the userPrefSave handler mass-assigns despite its readonly tags. Because the attacker must already hold a valid low-privilege account (PR:L in both the CVSS 4.0 vector and our assessed CVSS 3.1 vector), the realistic exposure is shared, hosted, or multi-tenant instances where registration or account provisioning is available to untrusted parties; fully anonymous exploitation is not possible. No public exploit code was identified at time of analysis and there is no confirmed vendor-released fix version, so operators should treat this as a credible, actionable escalation flaw rather than a mass-exploitation emergency.
Improper input validation in MISP's decaying model import endpoint allows an authenticated user with the perm_decaying permission to overwrite, re-own, or re-flag decaying models belonging to other organisations in MISP versions before 2.5.48. The import handler strips only the top-level id and uuid fields and pins org_id/default on the outer array before saving the record flat, so a nested 'DecayingModel' key can smuggle its own primary key, organisation identifier, and default flag past those guards, letting an attacker modify an existing model in place, reassign its organisation, or set it as the organisation default and thereby alter scoring behaviour for other users. This is a bounded authorization/mass-assignment flaw rather than an unauthenticated critical: successful exploitation requires network access to the instance plus an account holding perm_decaying (not granted to ordinary users by default), and there is no confidentiality or availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and an upstream fix commit (70e319e4b) exists.
MISP before 2.5.48 lets an authenticated user holding the delegation permission (perm_delegate) retarget an existing event-delegation record to any event on the instance by injecting an 'id' or 'event_id' field into the delegation submission, because the controller authorizes only the event named in the URL but persists the entire caller-supplied record. The injected row grants the attacker's organisation read access to the targeted event and, if the target organisation accepts the delegation, transfers ownership of that event and deletes the original record - a confidentiality and integrity impact rated 8.7 (CVSS:4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. Exploitation requires two concrete preconditions: an account with perm_delegate and the non-default, instance-wide MISP.delegation setting enabled; there is no public exploit identified at time of analysis, but a vendor fix is available in 2.5.48 (commit d1f5684f9).
Denial of service in the CSSOM JavaScript library through 0.5.0 allows unauthenticated remote attackers to terminate a parsing process by supplying a stylesheet declaration named 'length', a reserved property name that is not validated and therefore overwrites the internal declaration counter; the corrupted counter then drives an oversized memory allocation when cssText is serialized, crashing the process. Exploitation is conditional rather than automatic: the host application must feed attacker-controlled CSS into CSSStyleDeclaration.setProperty() or stylesheet parsing and must later serialize that declaration via cssText, so deployments that only parse trusted first-party CSS, or that never serialize untrusted input, are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the provided CVSS 4.0 score of 8.7 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a high availability-only impact with no confidentiality or integrity effect, and the library itself is not network-exposed.
Mass assignment in djust, a Django library providing Phoenix LiveView-style reactive server-side rendering, allows any client with an established WebSocket session to overwrite arbitrary public attributes on a LiveView instance through the framework's default `update_model` event handler. The handler ships in `djust.mixins.model_binding.ModelBindingMixin`, which sits in the LiveView base MRO and is therefore exposed by every view, and it `setattr`s a view attribute whose name is supplied entirely by the client - gated only by a 14-entry framework-internal denylist, an underscore-prefix rejection, and an opt-in `allowed_model_fields` allowlist that defaults to `None` (allow all). Affected deployments are djust versions prior to 1.0.7 that leave the allowlist unset and keep authorization, ownership, or business state such as `self.account_id`, `self.is_admin`, or `self.total_price` as public view attributes; the advisory's own reproducer set all three without any `dj-model` binding. Exploitation yields state tampering that can escalate to authorization-flag manipulation or IDOR when downstream handlers act on the tampered attributes without re-authorizing, giving a High integrity impact with no confidentiality or availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N); no public exploit code was identified at time of analysis and there is no CISA KEV entry, though the vendor retained a private reproducer.
Remote code execution in the SPIP CMS (all versions before 4.4.18) lets attackers holding a valid nonce inject rows into the internal spip_jobs cron table via the editer_objet action, ultimately executing arbitrary PHP. Because the arg parameter resolves SQL table names without an editable-columns allowlist, a crafted arg=job/0 request smuggles attacker-controlled fonction and args values that are unserialized and invoked when the job queue drains. Publicly available exploit code exists (Lexfo write-up chaining SQL injection to RCE), and the flaw was reported by VulnCheck.
Unrestricted property key injection via Spring Cloud Commons' writable /actuator/env endpoint allows authenticated administrators to POST arbitrary environment properties with no allow-list enforcement, affecting all currently maintained release lines (3.1.10 and earlier through 5.0.2). With CVSS PR:H and a scope change (S:C), exploitation requires admin-level access to the actuator endpoint but can cascade integrity impacts across the entire Spring application context. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default configuration requiring deliberate enablement of write access to the actuator endpoint.
Spring Data REST fails to protect entity identifier (@Id) and optimistic-locking version (@Version) fields from mutation through RFC 6902 JSON Patch (application/json-patch+json) PATCH requests, allowing authenticated low-privilege network attackers to overwrite primary keys and version counters on exposed JPA entities. Affected versions span the full 3.x lineage through 5.1.0, representing a broad swath of the Spring ecosystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Remote unauthenticated attackers can manipulate object attributes through the Apache Allura REST API in versions up to and including 1.21.0, because the API's object-binding logic (CWE-915, mass assignment) fails to whitelist which client-supplied fields may be written. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, giving a base score of 9.1 with high confidentiality and integrity impact and no availability impact, and no user interaction or credentials are required per that vector, though the practical exposure is limited by the small, largely self-hosted population of Allura instances and whether the affected write endpoints are reachable or gated behind authentication in a given deployment. Exploitation does not appear to be widespread: EPSS is only 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis; the vendor-released fix is Apache Allura 1.22.0.
Authenticated mass assignment in jshERP through 3.6 lets any user holding a valid low-privilege account overwrite protected fields on a user record - including tenant_id and password - by submitting a crafted PUT /user/update body, enabling silent cross-tenant identity switching on the next login or takeover of other accounts via password-hash overwrite. The vulnerable code path is the default UserController update handler and exploitation requires only an authenticated session (CVSS v3.1 base 8.7, PR:L, no user interaction or non-default configuration). Publicly available exploit code exists and no confirmed active exploitation (CISA KEV) has been reported at time of analysis.
Privilege escalation in GoatCounter through 2.7.0 lets an authenticated user - even one holding only read-only access - promote their own account to superuser by sending a form-encoded POST to /user/pref containing protected fields such as user.access[all]=* and user.email_verified=true, which the userPrefSave handler mass-assigns despite its readonly tags. Because the attacker must already hold a valid low-privilege account (PR:L in both the CVSS 4.0 vector and our assessed CVSS 3.1 vector), the realistic exposure is shared, hosted, or multi-tenant instances where registration or account provisioning is available to untrusted parties; fully anonymous exploitation is not possible. No public exploit code was identified at time of analysis and there is no confirmed vendor-released fix version, so operators should treat this as a credible, actionable escalation flaw rather than a mass-exploitation emergency.
Improper input validation in MISP's decaying model import endpoint allows an authenticated user with the perm_decaying permission to overwrite, re-own, or re-flag decaying models belonging to other organisations in MISP versions before 2.5.48. The import handler strips only the top-level id and uuid fields and pins org_id/default on the outer array before saving the record flat, so a nested 'DecayingModel' key can smuggle its own primary key, organisation identifier, and default flag past those guards, letting an attacker modify an existing model in place, reassign its organisation, or set it as the organisation default and thereby alter scoring behaviour for other users. This is a bounded authorization/mass-assignment flaw rather than an unauthenticated critical: successful exploitation requires network access to the instance plus an account holding perm_decaying (not granted to ordinary users by default), and there is no confidentiality or availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and an upstream fix commit (70e319e4b) exists.
MISP before 2.5.48 lets an authenticated user holding the delegation permission (perm_delegate) retarget an existing event-delegation record to any event on the instance by injecting an 'id' or 'event_id' field into the delegation submission, because the controller authorizes only the event named in the URL but persists the entire caller-supplied record. The injected row grants the attacker's organisation read access to the targeted event and, if the target organisation accepts the delegation, transfers ownership of that event and deletes the original record - a confidentiality and integrity impact rated 8.7 (CVSS:4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. Exploitation requires two concrete preconditions: an account with perm_delegate and the non-default, instance-wide MISP.delegation setting enabled; there is no public exploit identified at time of analysis, but a vendor fix is available in 2.5.48 (commit d1f5684f9).
Denial of service in the CSSOM JavaScript library through 0.5.0 allows unauthenticated remote attackers to terminate a parsing process by supplying a stylesheet declaration named 'length', a reserved property name that is not validated and therefore overwrites the internal declaration counter; the corrupted counter then drives an oversized memory allocation when cssText is serialized, crashing the process. Exploitation is conditional rather than automatic: the host application must feed attacker-controlled CSS into CSSStyleDeclaration.setProperty() or stylesheet parsing and must later serialize that declaration via cssText, so deployments that only parse trusted first-party CSS, or that never serialize untrusted input, are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the provided CVSS 4.0 score of 8.7 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a high availability-only impact with no confidentiality or integrity effect, and the library itself is not network-exposed.
Mass assignment in djust, a Django library providing Phoenix LiveView-style reactive server-side rendering, allows any client with an established WebSocket session to overwrite arbitrary public attributes on a LiveView instance through the framework's default `update_model` event handler. The handler ships in `djust.mixins.model_binding.ModelBindingMixin`, which sits in the LiveView base MRO and is therefore exposed by every view, and it `setattr`s a view attribute whose name is supplied entirely by the client - gated only by a 14-entry framework-internal denylist, an underscore-prefix rejection, and an opt-in `allowed_model_fields` allowlist that defaults to `None` (allow all). Affected deployments are djust versions prior to 1.0.7 that leave the allowlist unset and keep authorization, ownership, or business state such as `self.account_id`, `self.is_admin`, or `self.total_price` as public view attributes; the advisory's own reproducer set all three without any `dj-model` binding. Exploitation yields state tampering that can escalate to authorization-flag manipulation or IDOR when downstream handlers act on the tampered attributes without re-authorizing, giving a High integrity impact with no confidentiality or availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N); no public exploit code was identified at time of analysis and there is no CISA KEV entry, though the vendor retained a private reproducer.
Remote code execution in the SPIP CMS (all versions before 4.4.18) lets attackers holding a valid nonce inject rows into the internal spip_jobs cron table via the editer_objet action, ultimately executing arbitrary PHP. Because the arg parameter resolves SQL table names without an editable-columns allowlist, a crafted arg=job/0 request smuggles attacker-controlled fonction and args values that are unserialized and invoked when the job queue drains. Publicly available exploit code exists (Lexfo write-up chaining SQL injection to RCE), and the flaw was reported by VulnCheck.
Unrestricted property key injection via Spring Cloud Commons' writable /actuator/env endpoint allows authenticated administrators to POST arbitrary environment properties with no allow-list enforcement, affecting all currently maintained release lines (3.1.10 and earlier through 5.0.2). With CVSS PR:H and a scope change (S:C), exploitation requires admin-level access to the actuator endpoint but can cascade integrity impacts across the entire Spring application context. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default configuration requiring deliberate enablement of write access to the actuator endpoint.
Spring Data REST fails to protect entity identifier (@Id) and optimistic-locking version (@Version) fields from mutation through RFC 6902 JSON Patch (application/json-patch+json) PATCH requests, allowing authenticated low-privilege network attackers to overwrite primary keys and version counters on exposed JPA entities. Affected versions span the full 3.x lineage through 5.1.0, representing a broad swath of the Spring ecosystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.