Improper access control

2019-11-0619:15:00

PRIOn knowledge base

www.prio-n.com

9.5 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.6%

JSON

Computing For Good’s Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, “Improper Access Control.” As a result, an unauthenticated user may change the password of any administrator-level user.

CPENameOperatorVersion
computing_for_good\\'s_basic_laboratory_information_systemle3.4

CPE	Name	Operator	Version
	computing_for_good\\'s_basic_laboratory_information_system	le	3.4

References

blog.rapid7.com/2019/09/10/r7-2019-09-cve-2019-5617-cve-2019-5643-cve-2019-5644-c4g-blis-authentication-and-authorization-vulnerabilities-fixed/