PT-2023-12199 · Seeddms · Seeddms

Publicado 2023-06-07 · Atualizado 2023-06-15 · CVE-2021-33223

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeedDMS version 6.0.15

Description An issue in SeedDMS allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file.

Recommendations For SeedDMS version 6.0.15, consider restricting access to the out.UsrMgr.php file until a patch is available. As a temporary workaround, avoid using the userid and role parameters in the affected file to minimize the risk of exploitation.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2021-33223

Produtos afetados

Seeddms

Referências · 5

• 🔥 https://sunil-singh.notion.site/SeedDMS-6-0-15-Insecure-Direct-Object-Reference-IDOR-ff504354656b47b2b0cee0b7a82ad08c · Exploit
• https://t.me/cvenotify/51927 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-33223 · Nota de Segurança
• https://notion.so/SeedDMS-6-0-15-Incorrect-Access-Control-ff504354656b47b2b0cee0b7a82ad08c · Nota
• https://osv.dev/vulnerability/CVE-2021-33223 · Aviso do Fabricante