Altium 365 vulnerabilities
7 known vulnerabilities in Altium 365 from Altium. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
An incorrect authorization vulnerability exists in the Altium 365 Git Service.
An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of
- 9.4 Critical severity
Altium Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulation operations that use user-supplied paths without validation, allowing an authent
- 8.3 High severity
Altium Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365. An authenticated user can supply a crafted path parameter that bypasses validation, allowing arbitrary files (including entire di
- 10.0 Critical severity
Altium Enterprise Server: Improper Limitation of a Pathname to a Restricted Directory
Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary files to be w
- 8.3 High severity
Altium Enterprise Server: Exposure of Sensitive Information to an Unauthorized Actor
A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request whose input is treated as a URL by the server and used to issue an outbound H
- 10.0 Critical severity
Altium 365: Missing Authentication for Critical Functionality
A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker wh
- 9.0 Critical severity
Altium 365: Improper Access Control
Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScri