Vulnerabilities

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownership validation.

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in…

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current…

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication.

A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0.

A vulnerability has been found in zlt2000 microservices-platform up to 6.0.0 and classified as problematic.

A vulnerability, which was classified as problematic, was found in zlt2000 microservices-platform up to 6.0.0.