CyberRota Analysis
AI-GeneratedBaserow versions up to 2.3.2 contain a vulnerability in the Inactive Non-Staff User Handler that allows for improper authorization, potentially enabling remote exploitation, although the complexity of such an attack is high. While the maintainer suggests it may be more of a bug than a critical vulnerability, organizations using affected versions should prioritize upgrading to 2.3.3 to mitigate any potential risks. This is particularly relevant for those managing user authentication and access controls within their Baserow deployments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. The presence of this vulnerability remains uncertain at this time. Upgrading to version 2.3.3 can resolve this issue. The affected component should be upgraded. The project maintainer explains: "While the problem exists, I'm not really sure if it's a vulnerability. (....) Even though the back gives a token for a deactivate user, none of the endpoints actually work. That said, we will fix it, but so far it seems more like a bug instead of a vulnerability."