CyberRota Analysis
AI-GeneratedThe NewNotebook API is vulnerable due to inadequate parameter sanitization, allowing authenticated users with NOTEBOOK_EDIT permissions to write files outside the organization's designated data store. This exploitation can lead to the overwriting of critical metadata files, including ACL records, resulting in potential data corruption. Organizations utilizing the NewNotebook API should prioritize addressing this vulnerability to safeguard their data integrity.
Original NVD Description
The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.