IXP Manager has authenticated non-administrator privilege escalation

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…anager/security/advisories/GHSA-f5xv-q6fj-hfrc Diğer
• github.com/inex/IXP-Manager/releases/tag/v7.3.0 Diğer

Kayıt geçmişi

1. 31 Eki 2026 01:35Yayımlandı

İlgili açıklar

• 8,3 CVE-2026-63338IXP Manager has Broken Object-Level Authorization
• 8,7 CVE-2026-62990Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation
• 7,9 CVE-2026-62958libriscv: Out of bounds read vuln in the ELF parser (Denial of service)
• 5,3 CVE-2026-119342Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass
• 5,5 CVE-2026-119339Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` — Denial of Service
• 8,7 CVE-2026-62333OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots