Project

General

Profile

Actions
Copy link

Bug #15104

closed

A user with read only access can modify global parameters

Added by Benoît PECCATTE almost 5 years ago. Updated 9 months ago.

Status:
Released
Priority:
N/A
Assignee:
Elaad FURREEDAN
Category:
Security
Target version:
5.0.14
Pull Request:
https://github.com/Normation/rudder/p...
Severity:
Critical - prevents main use of Rudder | no workaround | data loss | security
UX impact:
User visibility:
Operational - other Techniques | Rudder settings | Plugins
Effort required:
Very Small
Priority:
0
Name check:
Reviewed
Fix check:
Error - Fixed
Regression:

Description

This is a security issue

Is seems that the user can also modify techniques in the editor.

Found in 5.0.11

Files

2019-09-16_16.01.23-Rudder_-_Management.png (34.2 KB) 2019-09-16_16.01.23-Rudder_-_Management.png François ARMAND, 2019-09-16 16:01

Subtasks 1 (0 open — 1 closed)

Bug #15904: "add global param" button still available for read-only roleReleasedNicolas CHARLESActions
Actions
Copy link

Also available in: Atom PDF