PT-2018-13225 · Vanilla · Vanilla

Publicado 2018-08-26 · Atualizado 2020-08-24 · CVE-2018-15833

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vanilla versions prior to 2.6.1

Description The issue allows for Insecure Direct Object Reference (IDOR) via the Poll ID, enabling a single user to select multiple Poll Options, such as voting for multiple items.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2018-15833

Produtos afetados

Vanilla

Referências · 6

• https://open.vanillaforums.com/discussion/36559 · Aviso do Fabricante
• https://twitter.com/viperbluff/status/1033067882941304832 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15833 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15833 · Aviso do Fabricante
• https://twitter.com/viperbluff/status/1033640333890834433 · Nota
• https://hackerone.com/reports/326434 · Nota