Descripción
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id} accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user-s DDNS profile configuration in the context of the attacker-s server. This issue has been patched in version 2.1.0.
CVSS 6.4EPSS 0.22799999999999998%Riesgo 0.65
Ver fuente- Publicación
- 2026-06-12 22:16:52
- Versiones afectadas
- >=2.0.14,<2.1.0
- Tipo
- Aplicación web
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L