CVE-2026-71278: CVE-2026-71278: kod enjeksiyonu

Açıklama (NVD)

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.

Özet bilgiler

CVSS v3.1

9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

%0,67 (yüzdelik 52)

CWE

CWE-94

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• github.com
• CWE-94