CVE-2020-9384

Опубликовано: 14 апр. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

An Insecure Direct Object Reference (IDOR) vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the application

Ссылки

http://packetstormsecurity.com/files/157197/Subex-ROC-Partner-Settlement-10.5-Insecure-Direct-Object-Reference.html
Exploit
Third Party Advisory
VDB Entry
https://www.subex.com/partner-settlement/
Vendor Advisory
http://packetstormsecurity.com/files/157197/Subex-ROC-Partner-Settlement-10.5-Insecure-Direct-Object-Reference.html
Exploit
Third Party Advisory
VDB Entry
https://www.subex.com/partner-settlement/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:subex:roc_partner_settlement:10.5:*:*:*:*:*:*:*

EPSS

Процентиль: 69%

0.00591

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-639

Связанные уязвимости

GHSA-pxrf-6xc9-mc6j