OneUptime Unauthorized User Account Creation Vulnerability
Vulnerability
A vulnerability in OneUptime version 9.0.5598 allows low-permission users to create new accounts via a direct API request, bypassing the intended user interface. This issue has been addressed in version 9.1.0.
Impact
Exploitation of this vulnerability allows for the creation of unauthorized user accounts.
Reproduction
To reproduce this vulnerability, a low-permission user must send a crafted API request to the user-creation endpoint. The system will then process the request and create the account, effectively bypassing the normal interface restrictions.
Remediation
Users can upgrade to OneUptime version 9.1.0 to address this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.