HexBrain

Nextcloud · Report #761329

Update App Store: Django account high jacking vulnerability

Validstatus
mediumseverity
11upvotes
31 Jan 2020disclosed

How it was found

High Severity Framework Security Fix

Impact

There's a nasty bug that allows accounts to be highjacked. Attackers still can't distribute archive since they are signed but can highjack admin accounts and swap out packges in the admin panel. I've updated the deps, tests work fine locally but you should check just to be sure and deploy the latest master branch ASAP

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original