Grouper
Monthly
Privilege escalation in Internet2 Grouper before 7.5.1 allows authenticated users with delegated rule creation or editing permissions in the User Interface to elevate their privileges, but only in certain configurations. This flaw (CWE-266) requires a non-default configuration and pre-existing authorization, moderating the headline critical severity; the attack is of high complexity per our independent assessment, and no public exploit identified at time of analysis. Upgrading to version 7.5.1 resolves the issue.
In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in UiV2Public.index in Internet2 Grouper 2.2 and 2.3 allows remote attackers to inject arbitrary web script or HTML via the code parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in Internet2 Grouper before 7.5.1 allows authenticated users with delegated rule creation or editing permissions in the User Interface to elevate their privileges, but only in certain configurations. This flaw (CWE-266) requires a non-default configuration and pre-existing authorization, moderating the headline critical severity; the attack is of high complexity per our independent assessment, and no public exploit identified at time of analysis. Upgrading to version 7.5.1 resolves the issue.
In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in UiV2Public.index in Internet2 Grouper 2.2 and 2.3 allows remote attackers to inject arbitrary web script or HTML via the code parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.