CVE-2024-44076: 
Java vulnerability analysis and mitigation

In Microcks before version 1.10.0, a security vulnerability was identified where the POST /api/import and POST /api/export endpoints allowed non-administrator access. The vulnerability was discovered and disclosed in August 2024, affecting all versions of Microcks prior to 1.10.0 (NVD, GitHub Issue).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from improper access control on critical API endpoints that should have been restricted to administrators only. The vulnerability allows unauthenticated access to import and export functionality, which should be privileged operations (NVD).

The vulnerability allows unauthorized users to access and utilize the import and export functionality of the application, which should be restricted to administrators only. This could potentially lead to unauthorized data access, system manipulation, and compromise of the application's security model (GitHub Issue).

The vulnerability is easily exploitable as it requires no special privileges or user interaction. An attacker can directly access the vulnerable endpoints without authentication. When calling the API in unauthenticated mode or with a token corresponding to a manager role, the requests are successful instead of being rejected (GitHub Issue).

The vulnerability has been fixed in Microcks version 1.10.0. Users are advised to upgrade to this version to address the security issue. The fix implements proper access controls on the affected endpoints, ensuring that only administrators can access the import and export functionality (GitHub Release).