Bonita Web 2021.2 - Authentication/Authorization Bypass
Bonita Web 2021.2 contains an authentication/authorization bypass vulnerability caused by an overly broad exclude pattern in RestAPIAuthorizationFilter, allowing unauthenticated users to access privileged API endpoints by appending ;i18ntranslation or /../i18ntranslation/ to the URL. References: https://nvd.nist.gov/vuln/detail/CVE-2022-25237 https://rhinosecuritylabs.com/application-security/cve-2022-25237-bonitasoft-authorization-bypass/ https://bonitasoft.com/ Remediation: Update Bonita Web to the latest version that addresses this vulnerability or implement proper access controls to restrict unauthorized API access.
Used 2.3k times · domain, subdomain, ipv4