PT-2023-26651 · Unknown · Gugoan Economizzer

Florian Walter · Published 2023-09-27 · Updated 2023-10-03 · CVE-2023-38872

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions gugoan Economizzer versions 0.9-beta1 gugoan Economizzer commit 3730880

Description An Insecure Direct Object Reference (IDOR) vulnerability allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.

Recommendations For gugoan Economizzer version 0.9-beta1, consider restricting access to cash book entry attachments until a patch is available. For gugoan Economizzer commit 3730880, avoid using the attachment Id in unauthenticated requests to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-38872

GHSA-896V-PH5W-379H

Affected Products

Gugoan Economizzer

References · 11

• 🔥 https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38872 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-38872 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38872 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-896v-ph5w-379h · Vendor Advisory
• https://github.com/gugoan/economizzer · Note
• https://github.com/gugoan/economizzer/commit/37308802dfe00d43df396a8afaa2096ece8b7b57 · Note
• https://t.me/cvenotify/58692 · Telegram Post
• https://t.me/cibsecurity/71171 · Telegram Post
• https://economizzer.org · Note
• https://twitter.com/CVEnew/status/1707238290641035599 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1707270611578257424 · Twitter Post