Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug] Hippo4j monitors unauthorized access vulnerabilities #1059

Open
laoquanshi opened this issue Feb 20, 2023 · 0 comments
Open

[Bug] Hippo4j monitors unauthorized access vulnerabilities #1059

laoquanshi opened this issue Feb 20, 2023 · 0 comments
Labels
type: bug Something isn't working type: security

Comments

@laoquanshi
Copy link

ThreadPoolController of the tenant Management module module of hippo4j. An unauthorized access vulnerability arises from thread pool deletion
DeletePool method to perform the current operation of user authentication, leads to any user can access the DELETE/hippo4j/v1 / cs/thread pool/DELETE interface deleting items within the thread pool
Influence version
hippo4j 1.4.3 (Nov 06, 2022)
Detailed path:
\ hippo4j - v1.4.3 \ hippo4j - server \ hippo4j - the console cn \ \ SRC \ main \ Java \ hippo4j \ console \ controller \ ThreadPoolController Java
Found in Java deletePool method in ThreadPoolController., locating defects in code
@yanrongzhen yanrongzhen added type: bug Something isn't working type: security labels Sep 1, 2023
@yanrongzhen yanrongzhen changed the title hippo4j monitors unauthorized access vulnerabilities [Bug] Hippo4j monitors unauthorized access vulnerabilities Sep 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type: bug Something isn't working type: security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@yanrongzhen @laoquanshi