PT-2023-20062 · Upv Peix · Upv Peix

Germán Planells García + 1 · Published 2023-10-03 · Updated 2023-10-05 · CVE-2023-2544

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions UPV PEIX (affected versions not specified)

Description The issue allows an authenticated user to bypass authorization and retrieve stored information of other registered users through a POST request by changing the ID parameter in the "pdf curri new.php" component.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-2544

Affected Products

Upv Peix

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-2544 · Security Note
• https://t.me/cibsecurity/71508 · Telegram Post
• https://twitter.com/CVEnew/status/1709196547307585710 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/authorization-bypass-upv-peix · Note
• https://t.me/cvenotify/59032 · Telegram Post
• https://twitter.com/DMFezzaReedCISA/status/1709240245818908928 · Twitter Post