CyberRota Analysis
AI-GeneratedThe vulnerability affects the Qinglong timed task management platform, specifically prior to version 2.20.1, allowing unauthenticated attackers to reset administrator credentials by exploiting a flaw in the init guard middleware. This could lead to unauthorized access and potential takeover of the system. Organizations using affected versions should prioritize upgrading to 2.20.1 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*', '/api/$1') rewrites the whitelisted /open/* path after JWT authentication and the guard have passed; an unauthenticated attacker can send PUT /open/user/init to reset administrator credentials on an initialized instance. This issue is fixed in 2.20.1.