Mwdb Core
Monthly
Missing authorization in MWDB Core's Remote Instances proxy API (versions >=2.2.0 to <2.19.0) lets an unauthenticated remote attacker relay arbitrary requests to a linked remote MWDB instance, executing them with the identity and permissions of the API key configured for that remote link. This effectively impersonates the API-key owner on the remote instance and enables unauthorized actions there. No public exploit identified at time of analysis; the flaw was reported by CERT-PL and is fixed in 2.19.0.
Missing authorization in MWDB Core versions 2.0.0 through 2.18.x allows any authenticated user to bypass capability-based access controls and upload malware configuration and text blob objects they are not permitted to add. The deprecated legacy endpoints `/config/<parent_dhash>` and `/blob/<parent_dhash>` silently accept an undocumented POST method that carries none of the `adding_configs` or `adding_blobs` capability checks enforced on the documented PUT method. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and network accessibility make it a meaningful privilege-boundary bypass in any multi-user MWDB Core deployment. Vendor-released patch v2.19.0 resolves the issue.
Missing authorization in MWDB Core's Remote Instances proxy API (versions >=2.2.0 to <2.19.0) lets an unauthenticated remote attacker relay arbitrary requests to a linked remote MWDB instance, executing them with the identity and permissions of the API key configured for that remote link. This effectively impersonates the API-key owner on the remote instance and enables unauthorized actions there. No public exploit identified at time of analysis; the flaw was reported by CERT-PL and is fixed in 2.19.0.
Missing authorization in MWDB Core versions 2.0.0 through 2.18.x allows any authenticated user to bypass capability-based access controls and upload malware configuration and text blob objects they are not permitted to add. The deprecated legacy endpoints `/config/<parent_dhash>` and `/blob/<parent_dhash>` silently accept an undocumented POST method that carries none of the `adding_configs` or `adding_blobs` capability checks enforced on the documented PUT method. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and network accessibility make it a meaningful privilege-boundary bypass in any multi-user MWDB Core deployment. Vendor-released patch v2.19.0 resolves the issue.