Openwisp Controller
Monthly
OpenWISP Controller versions 1.0.0 through 1.3.1 contain a missing-authorization flaw (CWE-862) in the CRL download endpoint: an authenticated organization manager holding CA view permission can retrieve another organization's certificate revocation list by iterating sequential CA identifiers. The exposure is limited to CRL contents - CA issuer information and revoked certificate serial numbers - with no private-key disclosure and no ability to modify data, and the sibling CA detail endpoint remains correctly scoped. It is fixed in 1.3.2; exploitation requires a multi-tenant deployment, and because django-x509 serves CRLs publicly by default unless DJANGO_X509_CRL_PROTECTED is enabled, only deployments that explicitly protect CRLs gain a new confidentiality exposure. Severity is low (CVSS 5.3 as published; assessed 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), no public exploit code is identified, and there is no KEV listing.
OpenWISP Controller versions 1.0.0 through 1.3.1 contain a missing-authorization flaw (CWE-862) in the CRL download endpoint: an authenticated organization manager holding CA view permission can retrieve another organization's certificate revocation list by iterating sequential CA identifiers. The exposure is limited to CRL contents - CA issuer information and revoked certificate serial numbers - with no private-key disclosure and no ability to modify data, and the sibling CA detail endpoint remains correctly scoped. It is fixed in 1.3.2; exploitation requires a multi-tenant deployment, and because django-x509 serves CRLs publicly by default unless DJANGO_X509_CRL_PROTECTED is enabled, only deployments that explicitly protect CRLs gain a new confidentiality exposure. Severity is low (CVSS 5.3 as published; assessed 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), no public exploit code is identified, and there is no KEV listing.