CVE-2023-32749

Pydio Cells allows users by default to create so-called external users in order to share files with them

High · published June 8, 2023

CVSS v3.1
8.8
EPSS
14%
Percentile
96.6
In the wild
Unconfirmed
What it is

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.14085 · 96.6th percentile
Published
2023-06-08T00:00Z
EPSS history
Timeline
  • 08 JUN 00:00Z
    Pydio Cells allows users by default to create so-called external users in order to share files with them
    cvelistv5