PT-2022-20299 · Ihb · Ihb Eg Flexnow

Published 2022-06-09 · Updated 2022-06-17 · CVE-2022-30760

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ihb eG FlexNow versions prior to 2.04.09.016

Description The issue is an Insecure Direct Object Reference (IDOR) that allows remote authenticated attackers to obtain sensitive student information, including final grades, study courses, and degrees. This is achieved by changing the student ID parameter in the HTTP POST request to the "FrontControllerSS" endpoint.

Recommendations For versions prior to 2.04.09.016, update to version 2.04.09.016 or later to resolve the issue. As a temporary workaround, consider restricting access to the "FrontControllerSS" endpoint or limiting the ability to modify the student ID parameter to prevent unauthorized access to sensitive student information.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-30760

Affected Products

Ihb Eg Flexnow

References · 5

• 🔥 https://homepage.ruhr-uni-bochum.de/Christian.Krug-q97/CVE-2022-30760.html · Exploit
• https://wiki.ihb-eg.de/doku.php/releasenotes/fn2web2.04.09 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30760 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30760 · Vendor Advisory
• https://t.me/cibsecurity/44130 · Telegram Post