IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without checking that `user_id` matches the caller, allowing access to another user's API-key record.
This issue is fixed in version 7.3.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
inex:ixp-manager
References 3
https://github.com/inex/IXP-Manager/security/advisories/GHSA-m7g4-g69h-vj5w
https://github.com/inex/IXP-Manager/security/advisories/GHSA-m7g4-g69h-vj5w
https://github.com/inex/IXP-Manager/commit/3856e93681cc5efdaf9e3a7f53a751081433…
https://github.com/inex/IXP-Manager/commit/3856e93681cc5efdaf9e3a7f53a751081433d021
https://github.com/inex/IXP-Manager/releases/tag/v7.3.0
https://github.com/inex/IXP-Manager/releases/tag/v7.3.0