MphRx Minerva Privilege Escalation Vulnerability

A vulnerability allowing privilege escalation has been identified in MphRx's Minerva version 3.6.0. This authorization vulnerability exists in the '/minerva/moUser/update' endpoint, where an authenticated user with user modification privileges can escalate their privileges by sending an HTTP request with a manipulated 'identifier' field. Exploiting this vulnerability could grant the user administrator privileges. Notably, this privilege escalation cannot be achieved through the graphical user interface.

Impact

Successful exploitation allows an authenticated user to gain administrator privileges.