PT-2023-12199 · Seeddms · Seeddms

Published 2023-06-07 · Updated 2023-06-15 · CVE-2021-33223

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeedDMS version 6.0.15

Description An issue in SeedDMS allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file.

Recommendations For SeedDMS version 6.0.15, consider restricting access to the out.UsrMgr.php file until a patch is available. As a temporary workaround, avoid using the userid and role parameters in the affected file to minimize the risk of exploitation.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2021-33223

Affected Products

Seeddms

References · 5

• 🔥 https://sunil-singh.notion.site/SeedDMS-6-0-15-Insecure-Direct-Object-Reference-IDOR-ff504354656b47b2b0cee0b7a82ad08c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33223 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33223 · Vendor Advisory
• https://t.me/cvenotify/51927 · Telegram Post
• https://notion.so/SeedDMS-6-0-15-Incorrect-Access-Control-ff504354656b47b2b0cee0b7a82ad08c · Note