Описание
Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator. This is possible because the application is vulnerable to CSRF.
Ссылки
- ExploitThird Party Advisory
- Product
- ExploitThird Party Advisory
- Product
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:imaworldhealth:bhima:1.27.0:*:*:*:*:*:*:*
EPSS
Процентиль: 24%
0.00082
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-269
CWE-269
Связанные уязвимости
CVSS3: 6.5
github
почти 3 года назад
Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator. This is possible because the application is vulnerable to CSRF.
EPSS
Процентиль: 24%
0.00082
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-269
CWE-269