OttoKit vulnerabilities

The OttoKit plugin (up to version 1.1.40) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.

There is an unauthenticated PHP Object Injection vulnerability in OttoKit versions <= 1.1.27.

OttoKit versions up to 1.1.35 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send requests from the server to internal resources.

The OttoKit suretriggers plugin by Brainstorm Force up to version 1.1.20 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.