Ixp Manager
Monthly
Privilege escalation in IXP Manager before 7.3.0 lets an authenticated, non-administrative account raise its own privileges to full administrator status over the network without user interaction. The flaw scores CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a low-privilege login but then gains high confidentiality, integrity and availability impact across the exchange's management plane. Exposure scales with the number of low-trust accounts an installation issues - deployments granting member or customer self-service logins carry the most risk, while single-operator instances with no untrusted accounts are largely insulated. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor fixed it in v7.3.0 and states that restricting administrative functions reduces but does not eliminate exposure.
Broken object-level authorization in IXP Manager before 7.3.0 allows any authenticated user to view and edit another user's API-key record through the ApiKeyController edit/update path, which selects records by identifier without verifying that the caller's user_id matches. The flaw requires a valid account and a deployment with more than one user, and it is fixed in v7.3.0; this is a credible but not emergency-grade priority, with no public exploit code or active exploitation identified at time of analysis. The vendor states that upgrading to v7.3.0 should be applied as soon as possible.
INEX IXP-Manager before 6.3.1 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability was found in INEX IPX-Manager up to 6.2.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Privilege escalation in IXP Manager before 7.3.0 lets an authenticated, non-administrative account raise its own privileges to full administrator status over the network without user interaction. The flaw scores CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a low-privilege login but then gains high confidentiality, integrity and availability impact across the exchange's management plane. Exposure scales with the number of low-trust accounts an installation issues - deployments granting member or customer self-service logins carry the most risk, while single-operator instances with no untrusted accounts are largely insulated. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor fixed it in v7.3.0 and states that restricting administrative functions reduces but does not eliminate exposure.
Broken object-level authorization in IXP Manager before 7.3.0 allows any authenticated user to view and edit another user's API-key record through the ApiKeyController edit/update path, which selects records by identifier without verifying that the caller's user_id matches. The flaw requires a valid account and a deployment with more than one user, and it is fixed in v7.3.0; this is a credible but not emergency-grade priority, with no public exploit code or active exploitation identified at time of analysis. The vendor states that upgrading to v7.3.0 should be applied as soon as possible.
INEX IXP-Manager before 6.3.1 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability was found in INEX IPX-Manager up to 6.2.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.