CVE-2020-23448

2021-01-2617:15:53

mitre

www.cve.org

cve-2020-23448

newbee-mall

incorrect access control

remote privilege gain

adminlogininterceptor.java

authentication logic

bypassed

AI Score

9.8

Confidence

High

EPSS

0.004

Percentile

73.6%

JSON

newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java. The authentication logic of the system’s background /admin is in code AdminLoginInterceptor, which can be bypassed.

References

github.com/newbee-ltd/newbee-mall/issues/34