Direct Object Reference

2018-11-3005:11:14

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

47.3%

JSON

ShowDoc is vulnerable to direct object reference. A remote attacker is able to navigate and retrieve or modify notes belonging to other users by modifying the page_id.

CPENameOperatorVersion
showdoc/showdocle2.4.1

CPE	Name	Operator	Version
	showdoc/showdoc	le	2.4.1

References

github.com/CCCCCrash/POCs/tree/master/Web/showdoc/IncorrectAccessControl#0x02-modify

github.com/star7th/showdoc/commit/bcdb5e3519285bdf81e618b3c9b90d22bc49e13c

github.com/star7th/showdoc/issues/397

0.001 Low

EPSS

Percentile

47.3%

JSON

Related for VERACODE:7904