PT-2023-21084 · Idweb · Idweb

Melodi Dey · Publicado 2023-10-25 · Atualizado 2024-09-25 · CVE-2023-27377

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IDWeb application versions 3.1.052 and earlier

Description The issue is related to missing authentication in the StudentPopupDetails EmergencyContactDetails method, allowing unauthenticated attackers to extract sensitive student data.

Recommendations For versions 3.1.052 and earlier, consider disabling the StudentPopupDetails EmergencyContactDetails method until a patch is available to prevent exploitation.

Correção

Missing Authentication

Improper Authentication

Enumeração de Fraquezas

CWE-306

CWE-287

Identificadores relacionados

CVE-2023-27377

Produtos afetados

Idweb

Referências · 6

• https://themissinglink.com.au/security-advisories/cve-2023-27377 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-27377 · Nota de Segurança
• https://twitter.com/cracbot/status/1717535458660376698 · Publicação no Twitter
• https://t.me/cvenotify/95936 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27377 · Aviso do Fabricante
• https://t.me/cibsecurity/72856 · Publicação no Telegram