Admin3
Monthly
Authenticated file upload in admin3 through 3.0.0 allows a user with an account and access to the storage handler to escape the configured storage root on Windows deployments by supplying filenames containing dot-dot path segments, overwriting any file the server process can write. The vulnerability requires authentication (CVSS 4.0 vector PR:L) and the reported escape path is Windows-specific, which narrows the exploitable population below what a raw network-vector score would suggest, and impact is bounded to files writable by the server process account. Publicly available exploit code exists, making the flaw a mid-tier but actionable finding for exposed Windows installations.
Session token harvesting in cjbi admin3 through version 3.0.0 lets any authenticated account holding the log:view permission read bearer credentials out of the audit-log event body returned by GET /logs. Because the UserLoggedIn domain-event handler writes the user's live session token into the logged event JSON, an attacker who opens the log-viewing screen can extract tokens belonging to other users - including administrators - and replay them as bearer credentials for full account takeover, yielding high confidentiality, integrity, and availability impact (CVSS 8.7). Publicly available exploit code exists (a PoC script is published for this CVE), though there is no indication of confirmed active exploitation; the assessed vector is AV:N/AC:L/PR:L/UI:N, so a valid low-privileged log-viewing session is mandatory, and the payoff depends on a higher-privileged user holding an active, unexpired session at the time the log is read.
Password cracking in admin3 3.0.0 and earlier allows anyone who obtains the application's credential database to recover user plaintext passwords offline, because stored credentials use single-round MD5 salted only with the username and no key-derivation function. The flaw does not grant database access by itself - it requires a prior compromise (database breach, SQL injection, exposed backup, or insider/privileged access, reflected by the CVSS PR:H prerequisite), but once that precondition is met, cracking is trivial on commodity hardware; publicly available exploit code exists. With a vendor score of 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) and no confirmed active exploitation, this is a genuine but conditional, low-to-moderate risk that amplifies the impact of an upstream data exposure rather than creating one.
Disabling or locking a user account in admin3 through 3.0.0 does not invalidate that user's existing bearer tokens, so a previously authenticated user retains full access with their original permissions after the account is disabled. The root cause is twofold: the AuthInterceptor never re-checks the user's locked status on subsequent requests, and LocalSessionManager resets session expiry on every request, so a pre-existing token never lapses through inactivity. Publicly available exploit code exists (a proof-of-concept account-lockout-bypass script), and exploitation requires that the attacker already held a valid token issued while their account was enabled (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, CVSS 5.4) - a rogue-insider or post-disable persistence scenario rather than unauthenticated compromise. Confirmed actively exploited (CISA KEV) status is not indicated by the available data, and there is no privilege escalation beyond the disabled account's original permission set.
Authenticated file upload in admin3 through 3.0.0 allows a user with an account and access to the storage handler to escape the configured storage root on Windows deployments by supplying filenames containing dot-dot path segments, overwriting any file the server process can write. The vulnerability requires authentication (CVSS 4.0 vector PR:L) and the reported escape path is Windows-specific, which narrows the exploitable population below what a raw network-vector score would suggest, and impact is bounded to files writable by the server process account. Publicly available exploit code exists, making the flaw a mid-tier but actionable finding for exposed Windows installations.
Session token harvesting in cjbi admin3 through version 3.0.0 lets any authenticated account holding the log:view permission read bearer credentials out of the audit-log event body returned by GET /logs. Because the UserLoggedIn domain-event handler writes the user's live session token into the logged event JSON, an attacker who opens the log-viewing screen can extract tokens belonging to other users - including administrators - and replay them as bearer credentials for full account takeover, yielding high confidentiality, integrity, and availability impact (CVSS 8.7). Publicly available exploit code exists (a PoC script is published for this CVE), though there is no indication of confirmed active exploitation; the assessed vector is AV:N/AC:L/PR:L/UI:N, so a valid low-privileged log-viewing session is mandatory, and the payoff depends on a higher-privileged user holding an active, unexpired session at the time the log is read.
Password cracking in admin3 3.0.0 and earlier allows anyone who obtains the application's credential database to recover user plaintext passwords offline, because stored credentials use single-round MD5 salted only with the username and no key-derivation function. The flaw does not grant database access by itself - it requires a prior compromise (database breach, SQL injection, exposed backup, or insider/privileged access, reflected by the CVSS PR:H prerequisite), but once that precondition is met, cracking is trivial on commodity hardware; publicly available exploit code exists. With a vendor score of 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) and no confirmed active exploitation, this is a genuine but conditional, low-to-moderate risk that amplifies the impact of an upstream data exposure rather than creating one.
Disabling or locking a user account in admin3 through 3.0.0 does not invalidate that user's existing bearer tokens, so a previously authenticated user retains full access with their original permissions after the account is disabled. The root cause is twofold: the AuthInterceptor never re-checks the user's locked status on subsequent requests, and LocalSessionManager resets session expiry on every request, so a pre-existing token never lapses through inactivity. Publicly available exploit code exists (a proof-of-concept account-lockout-bypass script), and exploitation requires that the attacker already held a valid token issued while their account was enabled (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, CVSS 5.4) - a rogue-insider or post-disable persistence scenario rather than unauthenticated compromise. Confirmed actively exploited (CISA KEV) status is not indicated by the available data, and there is no privilege escalation beyond the disabled account's original permission set.