Description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id} accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user-s DDNS profile configuration in the context of the attacker-s server. This issue has been patched in version 2.1.0.
CVSS 6.4EPSS 0.22799999999999998%Risque 0.65
Voir la source- Publication
- 2026-06-12 22:16:52
- Versions concernées
- >=2.0.14,<2.1.0
- Type
- Application web
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L