Hula Server
Monthly
An insecure direct object reference in HuLa-Server through 3.0.7 lets any authenticated user read other users' friend lists by sending a GET request to /user/friend/page with a victim's uid, because FriendController.friendList performs no owner or administrator check on the supplied identifier. The impact is read-only disclosure of contact lists (CWE-639, low confidentiality impact, no integrity or availability effect), so the practical exposure is social-graph and privacy leakage rather than account takeover. Exploitation requires a valid logged-in account (CVSS PR:L) plus knowledge or enumeration of victim uids; no verified working exploit code is identified in the available data, though a public technical writeup of the flaw is referenced, and the priority label places remediation within the current month rather than in an emergency window.
Authenticated users of HuLa-Server through 3.0.7 can delete other users' moments and their attached media, comments and likes by posting an arbitrary feedId to the /feed/del endpoint, because FeedController.delFeed never verifies that the caller owns the feed it deletes. The flaw is an insecure direct object reference (CWE-639) rated 5.3 that requires only a standard account and knowledge or enumeration of a victim's feedId, with impact confined to integrity and availability of feed content rather than data disclosure. It is a genuine but moderate-priority issue, not a top-tier emergency: no CISA KEV listing or confirmed active exploitation is present in the supplied intelligence, though public technical write-up references describing the attack exist and are not verified as working exploit code.
HuLa-Server through 3.0.7 contains an insecure direct object reference (IDOR) in PrivacyController that lets any authenticated user supply another user's uid to the /privacy endpoint and read or overwrite that user's UserPrivacy settings. The flaw is a server-side ownership-check failure (CWE-639), rated moderate severity (CVSS 5.3), with low confidentiality and integrity impact and no availability or code-execution impact. Exploitation requires a valid account (PR:L) but no admin or victim credentials; no CISA KEV entry or confirmed public exploit code is reported in the supplied intelligence.
An insecure direct object reference in HuLa-Server through 3.0.7 lets any authenticated user read other users' friend lists by sending a GET request to /user/friend/page with a victim's uid, because FriendController.friendList performs no owner or administrator check on the supplied identifier. The impact is read-only disclosure of contact lists (CWE-639, low confidentiality impact, no integrity or availability effect), so the practical exposure is social-graph and privacy leakage rather than account takeover. Exploitation requires a valid logged-in account (CVSS PR:L) plus knowledge or enumeration of victim uids; no verified working exploit code is identified in the available data, though a public technical writeup of the flaw is referenced, and the priority label places remediation within the current month rather than in an emergency window.
Authenticated users of HuLa-Server through 3.0.7 can delete other users' moments and their attached media, comments and likes by posting an arbitrary feedId to the /feed/del endpoint, because FeedController.delFeed never verifies that the caller owns the feed it deletes. The flaw is an insecure direct object reference (CWE-639) rated 5.3 that requires only a standard account and knowledge or enumeration of a victim's feedId, with impact confined to integrity and availability of feed content rather than data disclosure. It is a genuine but moderate-priority issue, not a top-tier emergency: no CISA KEV listing or confirmed active exploitation is present in the supplied intelligence, though public technical write-up references describing the attack exist and are not verified as working exploit code.
HuLa-Server through 3.0.7 contains an insecure direct object reference (IDOR) in PrivacyController that lets any authenticated user supply another user's uid to the /privacy endpoint and read or overwrite that user's UserPrivacy settings. The flaw is a server-side ownership-check failure (CWE-639), rated moderate severity (CVSS 5.3), with low confidentiality and integrity impact and no availability or code-execution impact. Exploitation requires a valid account (PR:L) but no admin or victim credentials; no CISA KEV entry or confirmed public exploit code is reported in the supplied intelligence.