3 ms·
> This vulnerability can be exploited by a remote authenticated privileged user via the Internet. I don’t get it. If you’re authenticated as a privileged user
by donmcronald 5y ago
> This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
I don’t get it. If you’re authenticated as a privileged user, don’t you have access anyway?
- dspillett 5y agoWhen holes like this are exploited it is in combination with other flaws like another app having an XSS flaw which allows a rogue script to make arbitrary connections. If you happen to have an active login session on the admin interface, that script could use the hole to make changes unbeknownst to you. Also in a situation where you have admins with different levels of access, exploits like this could allow an individual low on gruntles to create a privilege escalation situation and gain access to features they should not. So a low probability of exploit due to the mitigating factor, but a high potential for damage if an exploit is attempted and succeeds.