PT-2023-26651 · Unknown · Gugoan Economizzer

Florian Walter · Publicado 2023-09-27 · Atualizado 2023-10-03 · CVE-2023-38872

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions gugoan Economizzer versions 0.9-beta1 gugoan Economizzer commit 3730880

Description An Insecure Direct Object Reference (IDOR) vulnerability allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.

Recommendations For gugoan Economizzer version 0.9-beta1, consider restricting access to cash book entry attachments until a patch is available. For gugoan Economizzer commit 3730880, avoid using the attachment Id in unauthenticated requests to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-38872

GHSA-896V-PH5W-379H

Produtos afetados

Gugoan Economizzer

Referências · 11

• 🔥 https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38872 · Exploit
• https://github.com/gugoan/economizzer · Nota
• https://github.com/gugoan/economizzer/commit/37308802dfe00d43df396a8afaa2096ece8b7b57 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-38872 · Nota de Segurança
• https://t.me/cvenotify/58692 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-38872 · Aviso do Fabricante
• https://t.me/cibsecurity/71171 · Publicação no Telegram
• https://economizzer.org · Nota
• https://twitter.com/CVEnew/status/1707238290641035599 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-896v-ph5w-379h · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1707270611578257424 · Publicação no Twitter