Lucene search

[email protected]CVE-2021-35337

HistoryJul 01, 2021 - 2:15 p.m.

CVE-2021-35337

2021-07-0114:15:07

CWE-639

[email protected]

web.nvd.nist.gov

sourcecodester

phone shop

sales management system

insecure direct object reference

idor

nvd

cve-2021-35337

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.5 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

69.6%

JSON

Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter.

Affected configurations

NVD

Node

phone_shop_sales_management_system_projectphone_shop_sales_management_systemMatch1.0

CPENameOperatorVersion
phone_shop_sales_management_system_project:phone_shop_sales_management_systemphone shop sales management system project phone shop sales management systemeq1.0

CPE	Name	Operator	Version
phone_shop_sales_management_system_project:phone_shop_sales_management_system	phone shop sales management system project phone shop sales management system	eq	1.0

References

www.exploit-db.com/exploits/50050

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.5 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

69.6%

JSON

Related for CVE-2021-35337

nvd1 cnvd1 cvelist1 prion1