Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.4%
probabilidad de explotación
0.4%top 64% de las CVE
explotación observada
noninguna fuente lo reporta
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database access to fail, granting unauthenticated access to all protected endpoints. Version 0.2.4.4 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
maziggy · bambuddyReferencias
https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/core/auth.py#L473-L483https://github.com/maziggy/bambuddy/blob/449502cc9fc1cec04f06d31512420eac729fd032/backend/app/main.py#L5314-L5316https://github.com/maziggy/bambuddy/blob/main/CHANGELOG.mdhttps://github.com/maziggy/bambuddy/commit/845ad39b19bf99afeea571c6bae09695777e1460https://github.com/maziggy/bambuddy/releases/tag/v0.2.4.4https://github.com/maziggy/bambuddy/security/advisories/GHSA-6mf4-q26m-47pv