CVE-2021-36758
Medium
Description
1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the token is created in.
SeverityMedium
CVSS5.4
Exploit probability—
Product1password Connect
PublishedJul 16, 2021
First seenJul 16, 2021
How to fix
Update
- 1password connect1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 1password connect | v < 1.2 | 1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.