Описание
This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter dfclientid through API request URLs which could lead to unauthorized access to sensitive information belonging to other users.
Ссылки
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 5.5.002 (исключая)
cpe:2.3:a:shilpisoft:net_back_office:*:*:*:*:*:*:*:*
EPSS
Процентиль: 27%
0.00094
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-639
Связанные уязвимости
CVSS3: 6.5
github
больше 1 года назад
This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter dfclientid through API request URLs which could lead to unauthorized access to sensitive information belonging to other users.
EPSS
Процентиль: 27%
0.00094
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-639