PT-2018-13225 · Vanilla · Vanilla

Published 2018-08-26 · Updated 2020-08-24 · CVE-2018-15833

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vanilla versions prior to 2.6.1

Description The issue allows for Insecure Direct Object Reference (IDOR) via the Poll ID, enabling a single user to select multiple Poll Options, such as voting for multiple items.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2018-15833

Affected Products

Vanilla

References · 6

• https://open.vanillaforums.com/discussion/36559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15833 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15833 · Vendor Advisory
• https://twitter.com/viperbluff/status/1033067882941304832 · Note
• https://twitter.com/viperbluff/status/1033640333890834433 · Note
• https://hackerone.com/reports/326434 · Note