PT-2020-17409 · Newgen · Newgen Egov

Ali Al Sinan · Published 2020-12-30 · Updated 2021-02-24 · CVE-2020-35737

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Newgen eGov version 12.0

Description The issue allows an attacker to modify other users' profile information by manipulating the unvalidated UserIndex parameter, which is an example of an Insecure Direct Object Reference. This means that an attacker can access and alter sensitive information of other users without proper authorization.

Recommendations For Newgen eGov version 12.0, consider restricting access to the UserIndex parameter to prevent unauthorized modifications to user profiles. As a temporary workaround, restrict the ability to modify other users' profile information until a proper validation mechanism for the UserIndex parameter is implemented.

Exploit

Fix

Related Identifiers

CVE-2020-35737

Affected Products

Newgen Egov

References · 7

• 🔥 http://packetstormsecurity.com/files/160826/Newgen-Correspondence-Management-System-eGov-12.0-Insecure-Direct-Object-Reference.html · Exploit
• 🔥 https://exploit-db.com/exploits/49378 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-35737 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35737 · Vendor Advisory
• https://t.me/cvenotify/7981 · Telegram Post
• https://t.me/cvenotify/8292 · Telegram Post
• https://gist.github.com/AliAlsinan/0323e57d2345ef0b4e73c803dba93486 · Note