CyberRota Analysis
AI-GeneratedThe zlt2000 microservices platform versions up to 6.0.0 are vulnerable due to an authorization bypass in the file-center module, allowing authenticated attackers to delete arbitrary files and metadata without proper ownership validation. This vulnerability enables attackers to enumerate file identifiers and exploit the DELETE endpoint, posing a significant risk to data integrity and confidentiality. Organizations using this platform should prioritize remediation to prevent unauthorized data deletion and potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metadata by supplying their identifiers to the delete endpoint.