Lucene search

MitreCVE-2023-38335

HistoryJul 20, 2023 - 6:15 p.m.

CVE-2023-38335

2023-07-2018:15:12

CWE-276

mitre

web.nvd.nist.gov

omnis studio

access control

cve-2023-38335

security issue

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.006

Percentile

79.1%

JSON

Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries “always private” - this is supposed to be an irreversible operation. However, due to implementation issues, “always private” Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an “irreversible operation”.

Affected configurations

Nvd

Node

omnisstudioMatch10.22.00

VendorProductVersionCPE
omnisstudio10.22.00cpe:2.3:a:omnis:studio:10.22.00:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
omnis	studio	10.22.00	cpe:2.3:a:omnis:studio:10.22.00:::::::*

References

packetstormsecurity.com/files/173695/Omnis-Studio-10.22.00-Library-Setting-Bypass.html

seclists.org/fulldisclosure/2023/Jul/41

seclists.org/fulldisclosure/2023/Jul/43

www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-005.txt

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

0.006

Percentile

79.1%

JSON

Related for CVE-2023-38335