Описание
ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.
Ссылки
- ExploitThird Party Advisory
- Product
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:projectsend:projectsend:r1605:*:*:*:*:*:*:*
EPSS
Процентиль: 14%
0.00046
Низкий
7.5 High
CVSS3
Дефекты
CWE-639
Связанные уязвимости
CVSS3: 9.8
github
около 2 месяцев назад
ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.
EPSS
Процентиль: 14%
0.00046
Низкий
7.5 High
CVSS3
Дефекты
CWE-639