CVE-2022-36110
Netmaker vulnerable to Insufficient Granularity of Access Control
Impact
### Impact Improper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API. In addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system. ### Patches This problem has been patched in v0.15.1. To apply: 1. docker-compose down 2. docker pull gravitl/netmaker:v0.15.1 3. docker-compose up -d ### For more information If you have any questions or comments about this advisory: Email us at [info@netmaker.io](mailto:info@netmaker.io) This vulnerability was brought to our attention by @tweidinger
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/gravitl/netmaker | < 0.15.1 | 0.15.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netmaker | Netmaker | before 0.15.1 |