CVE-2024-0550 — Privileged User using traversal to read system files
A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any v…
Published: 2024-02-28 · CVSS: 9.6 · CVSS 3.0
A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7