GHSA-387r-2vfq-vrmf: Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait
Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digitalassets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Vvveb through 1.0.8.6 where multiple vendors use the shared storage/digital_assets directory are exposed. Low-privilege vendor accounts can target digital assets belonging to other vendors.
What does an attacker need to exploit it?
An attacker needs a low-privilege vendor account and knowledge of another vendor's asset filename. They can submit rename, delete, or upload requests to product/digital-asset using that filename.
What is the practical impact of successful exploitation?
An attacker can rename, delete, or overwrite another vendor's digital-asset files. This can break downloads or replace legitimate assets with malicious content.