Zentaopms
Monthly
ZenTao PMS before 22.3 permits authenticated low-privilege users to bypass group-based access controls by invoking any controller method whose name contains 'ajax', potentially exposing sensitive data and administrative actions. The flaw in commonModel::isOpenMethod() treats such methods as open, enabling calls such as task.ajaxGetByID, system.ajaxDBAuthUrl, and admin.ajaxChangeTableEngine to read records, retrieve database credentials, trigger CI jobs, and alter tables. Exploitation requires a valid low-privilege session; no public exploit was identified at time of analysis, and the vendor has released 22.3 with an explicit privilege allow-list. The issue is rated CVSS 4.0 7.1 (High) with high confidentiality impact and low integrity impact.
Authenticated users can exploit an authorization bypass in ZenTao PMS through 22.6 to read and overwrite other users' comments by iterating sequential action IDs. This IDOR (CWE-639) in action::editComment allows low-privileged users to modify comments on bugs, stories, tasks, and documents in projects and products they cannot access, and view associated content and attachments. No public exploit code or active exploitation has been identified; the assessed CVSS 3.1 base score is 5.3 (moderate), requiring a valid authenticated session.
ZenTao PMS before 22.3 permits authenticated low-privilege users to bypass group-based access controls by invoking any controller method whose name contains 'ajax', potentially exposing sensitive data and administrative actions. The flaw in commonModel::isOpenMethod() treats such methods as open, enabling calls such as task.ajaxGetByID, system.ajaxDBAuthUrl, and admin.ajaxChangeTableEngine to read records, retrieve database credentials, trigger CI jobs, and alter tables. Exploitation requires a valid low-privilege session; no public exploit was identified at time of analysis, and the vendor has released 22.3 with an explicit privilege allow-list. The issue is rated CVSS 4.0 7.1 (High) with high confidentiality impact and low integrity impact.
Authenticated users can exploit an authorization bypass in ZenTao PMS through 22.6 to read and overwrite other users' comments by iterating sequential action IDs. This IDOR (CWE-639) in action::editComment allows low-privileged users to modify comments on bugs, stories, tasks, and documents in projects and products they cannot access, and view associated content and attachments. No public exploit code or active exploitation has been identified; the assessed CVSS 3.1 base score is 5.3 (moderate), requiring a valid authenticated session.