Lucene search

GitHub Advisory DatabaseGHSA-PWW3-X2G7-X8Q2

HistoryApr 12, 2024 - 12:30 a.m.

Reportico affected by Incorrect Access Control

2024-04-1200:30:26

CWE-639

GitHub Advisory Database

github.com

reportico

vulnerability

execute_mode

parameter

software

access control

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

Percentile

9.0%

JSON

An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL.

Affected configurations

Vulners

Node

reportico-webreporticoRange≤8.1.0

VendorProductVersionCPE
reportico-webreportico*cpe:2.3:a:reportico-web:reportico:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
reportico-web	reportico	*	cpe:2.3:a:reportico-web:reportico::::::::

References

gist.github.com/aashiqahamedn/39383cfbc639cbdc3e1a7d74b977aeae

github.com/advisories/GHSA-pww3-x2g7-x8q2

github.com/reportico-web/reportico/issues/51

nvd.nist.gov/vuln/detail/CVE-2023-48865

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for GHSA-PWW3-X2G7-X8Q2