Peppermint vulnerabilities
We track 3 vulnerabilities in Peppermint products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2023.
3vulnerabilities
0critical
3high
0exploited
8.1average CVSS score
Latest Peppermint vulnerabilities
- 7.5 High severity
Peppermint: Improper Limitation of a Pathname to a Restricted Directory
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request.
- 8.8 High severity
Peppermint: Use of Hard-coded Credentials
An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie.
- 8.1 High severity
Peppermint: Authorization Bypass Through User-Controlled Key
An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request.