Wharttest
Monthly
Unauthenticated WebSocket access in WHartTest through 2.8.1 lets remote attackers connect to the /ws/ui/web/ and /ws/ui/actuator/ endpoints without credentials, register an actuator under a client-supplied id, and thereby intercept other users' test-case payloads while spoofing step results and screen frames into victim UI-automation sessions. Exploitation is practical only where the Django Channels endpoints are network-reachable and concurrent test traffic exists, since the flaw yields limited confidentiality and integrity impact with no availability effect (independent assessment CVSS 3.1 5.3 medium; vendor-published v4.0 score 6.9). No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch is currently documented in the available data.
Unauthenticated WebSocket access in WHartTest through 2.8.1 lets remote attackers connect to the /ws/ui/web/ and /ws/ui/actuator/ endpoints without credentials, register an actuator under a client-supplied id, and thereby intercept other users' test-case payloads while spoofing step results and screen frames into victim UI-automation sessions. Exploitation is practical only where the Django Channels endpoints are network-reachable and concurrent test traffic exists, since the flaw yields limited confidentiality and integrity impact with no availability effect (independent assessment CVSS 3.1 5.3 medium; vendor-published v4.0 score 6.9). No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch is currently documented in the available data.