Lucene search

MitreCVE-2023-50872

HistoryApr 16, 2024 - 4:15 p.m.

CVE-2023-50872

2024-04-1616:15:08

CWE-200

mitre

web.nvd.nist.gov

accredible credential.net

api

insecure direct object reference

disclosure

certificates

holder

security issue

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

Percentile

9.0%

JSON

The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses partial information about certificates and their respective holder. NOTE: the excellium-services.com web page about this issue mentions “Vendor says that it’s not a security issue.”

References

excellium-services.com/cert-xlm-advisory/CVE-2023-50872

help.accredible.com/accredible-product-release-notes

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2023-50872