io.openremote:openremote-manager@1.24.2

latest version

1.27.1

latest non vulnerable version

1.27.1

first published

1 years ago

latest version published

15 hours ago

licenses detected

AGPL-3.0
[1.2.0,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the io.openremote:openremote-manager package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H SQL Injection Affected versions of this package are vulnerable to SQL Injection in the datapoint export process when asset display names are concatenated into SQL queries without proper escaping. An attacker can exfiltrate database data by injecting malicious SQL through the asset name and retrieving the results in the exported CSV file. This is only exploitable if the attacker has a valid authenticated session with permissions to create or rename assets and export datapoints using the crosstab export format. How to fix SQL Injection? Upgrade `io.openremote:openremote-manager` to version 1.26.0 or higher.	[,1.26.0)
H Authorization Bypass Through User-Controlled Key Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the `removeAlarms` process. An attacker can permanently delete alarm records belonging to other tenants by supplying arbitrary alarm IDs in a bulk delete request. This can result in the destruction of safety-critical and security alerts, as well as enable enumeration of alarm IDs across tenants. How to fix Authorization Bypass Through User-Controlled Key? Upgrade `io.openremote:openremote-manager` to version 1.25.0 or higher.	[,1.25.0)

SQL Injection

Affected versions of this package are vulnerable to SQL Injection in the datapoint export process when asset display names are concatenated into SQL queries without proper escaping. An attacker can exfiltrate database data by injecting malicious SQL through the asset name and retrieving the results in the exported CSV file. This is only exploitable if the attacker has a valid authenticated session with permissions to create or rename assets and export datapoints using the crosstab export format.

How to fix SQL Injection?

Upgrade io.openremote:openremote-manager to version 1.26.0 or higher.

[,1.26.0)

Authorization Bypass Through User-Controlled Key

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the removeAlarms process. An attacker can permanently delete alarm records belonging to other tenants by supplying arbitrary alarm IDs in a bulk delete request. This can result in the destruction of safety-critical and security alerts, as well as enable enumeration of alarm IDs across tenants.

How to fix Authorization Bypass Through User-Controlled Key?

Upgrade io.openremote:openremote-manager to version 1.25.0 or higher.

[,1.25.0)

Go back to all versions of this package