Skip to content

Malicious user can rapidly create API keys for own account.

Moderate
DaneEveritt published GHSA-pjmh-7xfm-r4x9 Mar 31, 2020

Package

app/Http/Controllers/Base/AccountKeyController.php

Affected versions

<= 0.7.16

Patched versions

0.7.17

Description

Impact

A malicious user can perform a DoS attack against the database layer by rapidly generating API keys for their account.

Workarounds

Manually throttling the API endpoint by adding the following code to the routes file is one solution, the other is to simply update to at least 0.7.17.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

No CWEs