CVE-2021-31590

https://notcve.org/view.php?id=CVE-2021-31590

PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system. PwnDoc todas las versiones hasta la 0.4.0 (2021-08-23) tiene un manejo incorrecto de JSON Webtoken, lo que lleva a un control de acceso incorrecto. Con un Webtoken JSON válido que se utiliza para la autenticación y la autorización, un usuario puede mantener sus privilegios de administrador incluso si es degradado al privilegio de "usuario". • https://github.com/pwndoc/pwndoc/blob/59519735b0d831d8fd96d7c3387f66d28407e583/CHANGELOG.md#040-2021-08-23 https://github.com/pwndoc/pwndoc/commit/15f3dc0e212eda465e05fda0feb002d1bce2939d https://github.com/pwndoc/pwndoc/commit/ff1b868cec55f5b6c7a91e15a2b0b1f4324121ab https://github.com/pwndoc/pwndoc/pull/128 https://github.com/pwndoc/pwndoc/pull/74 https://github.com/pwndoc/pwndoc/security/advisories https://www.dgc.org/responsible_disclosure_pwndoc_jwt •