Medium, CVSS 6.9PyPIAmendedPublished
Authorization Bypass in I hate money
CVE-2020-15120 · GHSA-67j9-c52g-w2q9
- Affected
- PyPI ihatemoney < 4.1.5
- Fixed in
- 4.1.5· Vendor fix available
- Issue
- Impact An authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. Patches Workarounds To limit the impact, it is possible to disable public project creation by setting ALLOWPUBLICPROJECTCREATION = False in the configuration (see documentation). Existing users will still be able to exploit the flaw, but this will prevent an external attacker from creating a new project. For more information Person.query.get() and Person.query.getbyname() were mistakenly running a database join on the Project table…
Recommended action: Upgrade to 4.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.