Missing privilege checks for local sync jobs
Affected packages
proxmox-backup-server
Details
An attacker with highly privileged access to one datastore + namespace could set up a "local" sync job pulling from arbitrary datastores.
This issue was discovered internally and independently by Project Loupe.
Fixed in
- proxmox-backup-server >= 4.2.8-1
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.